MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Feeds

Researchers introduced IBIA, an Indirect Bias Injection Attack that plants adversary-aligned stances into personal AI agents' persistent memory via external content such as social media feeds, achieving 91.2% average adversary-aligned response rates across four downstream tasks in the OpenClaw setting, including 86.6% on GPT-5.5. The attack combines comment cloaking, watermarking, and category anchoring, and was evaluated on BiasBench with 6,000 social comments and 120 email instances. A proposed memory boundary defense reduces AARs to 80.6%.

arXiv:2608.22061v1 Announce Type: new Abstract: Personal AI agents routinely consume external content while performing tasks such as web browsing, email processing, and SNS feed summarization, and they retain selected information or execution results in persistent memory for later use. We show that this ordinary ingestion of external content opens an indirect path for manipulating subsequent agent behavior. Based on this observation, we present IBIA, an Indirect Bias Injection Attack that plants an adversary-aligned stance on a specific topic into a victim agent's memory through external content, without direct access to the agent, its memory, or future user queries. For this, IBIA combines three mechanisms: comment cloaking, which keeps the crafted content consistent with the surrounding discussion, comment watermarking, which enables lightweight identification during curation, and category anchoring, which makes the retained stance salient under later related requests. We evaluate IBIA on BiasBench, a benchmark of 6,000 adversary-crafted social comments and 120 email instances. The watermark-based curation identifies 95.9% of the injected comments. Under the OpenClaw setting, IBIA achieves adversary-aligned response rates AARs of 91.2% on average across four downstream tasks, including 86.6% on the frontier GPT-5.5. We further propose a memory boundary defense that detects the injected bias and reduces AARs to 80.6%.