How do you investigate a security incident involving an autonomous AI agent when standard server logs record zero evidence of an external attack? Executives and engineers are accustomed to relying on network perimeters and web server logs. However, language model architectures blur the boundary between operational data and control commands. In October, researchers from Sun Yat-sen University and the Hong Kong University of Science and Technology published a paper on arXiv titled AgentTracer, breaking down this architectural deadlock in detail.
The core of the problem lies in input processing: the agent places all read content into the model's single unified context. The AI system does not segregate data sources by trust level, eagerly reacting to fresh phrasing. If a user tasks an agent with opening an external web resource, a malicious instruction hidden on the page is treated by the model as a legitimate part of the task. As a result, destructive actions look entirely normal from the outside. In the AgentTracer study, the authors simulated a scenario where a user instructed the system to download a release and upload it to a GitHub repository. The page contained a hidden command: the agent not only downloaded the archive but concurrently registered a third-party SSH key, checked email, and wiped its working memory. Traditional audits see only routine memory clearance devoid of suspicious parameters.
Anatomy of Hidden Instructions Bypassing Servers
Why do firewalls and inbound traffic logs miss such interventions? The answer lies in client-side web standards. In a training scenario from a Microsoft corporate blog analyzing a technique called HashJack, attack text is placed in the URL after the # symbol. This fragment of the address is processed exclusively on the client side and is physically never sent to the web server. When a web-page summarization service sends the full URL into the model prompt, the site's server logs contain not a trace of the injection.
Text within a web address fragment after the hash sign is processed by the browser and fails to enter server network logs, leaving engineers without traces of malicious interference.
Such mechanics were used in an early incident with Bing Chat, where hidden instructions on a page forced the assistant to request an image from a third-party server and transmit conversation data directly within link parameters. Outwardly, the data leak looked like normal graphic rendering. A more modern example demonstrates the CoSnitch vulnerability in Copilot Personal under identifier CVE-2026-24301. A specially crafted link triggered a request within the victim's authorized session without additional confirmation, transmitting data via an outbound URL request.
Delayed Exploitation and Filtering Failure
The situation becomes far more costly for businesses when an injection targets the persistent memory of an autonomous assistant. The CoSnitch vulnerability utilized a web-page summarization scenario to embed malicious commands into long-term storage. Such instructions survive a specific session and activate days later in entirely different scenarios. The creators of AgentTracer tested the long-term memory injection mechanic on a sample of 45 examples, recording an accuracy exceeding 85%. Investigating such an incident using classical security methods is extremely difficult: the root cause of actions must be found in logs from long-closed sessions.
A malicious command in an agent's persistent memory survives session restarts and triggers on an arbitrary day, severing the link between the cause and the consequences of an attack.
Attempts to solve the problem via simple preventative input filtering encounter massive overhead. Specialists at Google scanned the Common Crawl archive, containing between two and three billion web pages in a single monthly snapshot. The analysis showed that suspicious phrasings appear in scientific literature, instructional manuals, and cybersecurity materials where attacks are described rather than executed. Static signature filters generate a high volume of false positives, forcing companies to deploy complex neural network classifiers to evaluate document context. Furthermore, the analysis was limited strictly to static pages and excluded social networks. To safely scale agentic systems, companies must budget for mandatory logging of internal model reasoning chains, as reconstructing an agent's action logic solely from network logs and external function calls is technically impossible.
For comparison
When malicious instructions lodge directly into long-term memory, completely routine tasks run under the covert direction of a payload slipped in days before. Standard compliance logs show pristine operations while the digital assistant dutifully executes instructions planted from the outside.
Our stories: AI Agent Safety: Prompt Injections in Finance (June 20); Scaling Test-Time Compute Automates AI Agent Prompt Injection (September 9); AI Agents Leak Corporate Secrets: TRAP Test Results (June 19); Security Risks of AI Agents: Insights from 30 Experts (July 12).