A new benchmark just showed how easily AI agents with long-term memory can be turned into time-delayed data leaks.
Researchers built Trojan Hippo Bench, a testing framework that plants a dormant instruction inside an AI agent's memory through a single untrusted tool call, like a booby-trapped email. The payload sits inactive through as many as 100 normal sessions, waiting for the user to bring up finance, health, or identity topics before it activates and quietly sends sensitive data to an attacker. Tested against an email assistant running four different memory setups (explicit tool memory, agentic memory, retrieval-augmented generation, and sliding-window context), the attack succeeded 85 to 100 percent of the time against current frontier models from OpenAI and Google. The researchers also tested four defenses built on basic security principles, which cut the attack success rate down to 0 to 5 percent.
Memory is the feature that makes AI agents feel useful over time, remembering your preferences instead of starting from scratch every session. This research shows that same feature can double as a persistent backdoor that survives months of normal use, and it's a meaningfully different threat than the prompt-injection bugs most security teams already know to watch for.
The defenses work, but the paper is upfront that they cost usability in ways that vary by task, so any claim of a fix deserves the same skepticism we'd give a vendor's launch announcement.