ZombieAgent Scenario

ZombieAgent Scenario

ZombieAgent is a cross-session memory poisoning scenario. It demonstrates how a malicious instruction can be planted in persistent memory during one session and then revived later as apparently trusted context.

Unprotected Attack Chain

1. An agent reads an untrusted input such as an email containing hidden hostile instructions.
2. The agent writes a derived conclusion or instruction into persistent memory.
3. In a later session, the agent loads that memory and treats it as trusted self-context.
4. The agent executes the payload through a legitimate tool, such as sending an email or making an external request.

Hypervisor Defense

Agent Hypervisor breaks the chain at multiple structural boundaries:

Boundary	Defense
Input virtualization	Raw inputs become semantic events with explicit trust and provenance
Capability boundary	Untrusted sources cannot trigger capabilities outside their manifest grant
Memory write	Tainted data carries provenance into persistent storage
Session crossing	Loaded memory retains taint and lineage in later sessions
External side effect	Tainted triggers are blocked by deterministic policy

Key Lesson

The defense does not depend on the agent noticing that text is malicious. It depends on the manifest, provenance chain, and taint rules making the dangerous execution path unavailable.

See also

• Trust Taint and Provenance
• Manifest Resolution Law
• World Manifest