RESEARCH
December 2025: poisoned agent memory, Telegram, charging on someone else's bill
December 2025 takes AI agents onto new ground: poisoned memories that persist across sessions, injections that work from any source and prompts that trap a service in endless reasoning. On the cryptographic side, Telegram and electric-vehicle plug-and-charge show concrete weaknesses. The month closes with virtual machine escapes and consent violations in web forms.
Archive: reconstruction written in November 2026
1. MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
arXiv · Saksham Sahai Srivastava, Haoyu He · AI & LLM Security
In short: MemoryGraft plants fake successful experiences in an agent's long-term memory, which the agent then imitates.
LLM agents store past experiences to improve. MemoryGraft abuses this habit: through harmless-looking content read during a task, it leads the agent to save malicious procedures among its successful memories. When similar tasks arrive, the agent retrieves and copies them. A few poisoned records come to dominate retrieved memories, with effects that persist across sessions.
Why it matters. A compromise that lives in the agent's memory is not wiped by closing the session: incident response must include cleaning that memory.
Read the paper · PDF · Code
2. ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
Network and Distributed System Security Symposium · Reachal Wang, Yuqi Jia, Neil Zhenqiang Gong · AI & LLM Security
In short: ObliInjection works even when the attacker controls one source in a hundred and doesn't know the reading order.
An LLM application's input often merges text from several sources, and attackers control only some of them without knowing their order. ObliInjection is the first prompt injection designed for this setting: it optimises the malicious text to work under any ordering. Across three datasets and twelve LLMs it stays effective even with one contaminated segment out of 6-100.
Why it matters. Assistants that summarise reviews, emails or multi-author documents can be hijacked by a single hostile contribution.
Read the paper · PDF · Code
3. ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking
Network and Distributed System Security Symposium · Yunzhe Li, Jianan Wang, Hongzi Zhu, James Lin et al.
In short: ThinkTrap finds prompts that make an LLM reason endlessly, cutting a commercial service to 1% of capacity.
Cloud LLM services face a new kind of denial of service: inputs that push the model into extremely long or endless generation. ThinkTrap finds such prompts without access to the model, optimising in a low-dimensional continuous space. Against closed commercial services, even under a ten-requests-per-minute cap, it cuts throughput to 1% and sometimes causes complete failure.
Why it matters. Providers of LLM-based services face outages and runaway compute costs: limits on reasoning length become an essential control.
4. Chasing Shadows: Pitfalls in LLM Security Research
Network and Distributed System Security Symposium · Jonathan Evertz, Niklas Risse, Nicolai Neuer, Andreas Müller et al.
In short: All 72 LLM security papers reviewed contain at least one of nine recurring methodological pitfalls.
LLMs make reproducibility and evaluation harder in security research. The authors identify nine recurring pitfalls, from data collection to prompting, and look for them in all 72 papers published at top security and software-engineering venues in 2023-2024: each has at least one, yet only 15.7% are discussed. Four case studies show inflated results.
Why it matters. Claimed performance of LLM-based security tools should be read with caution before a company relies on it.
5. Four Attacks and a Proof for Telegram
Journal of Cryptology · Martin R. Albrecht, Lenka Mareková, Kenneth G. Paterson, Igors Stepanovs · Formal Methods & Verification
In short: Four attacks and a formal proof on the symmetric cryptography of MTProto, Telegram's protocol.
This is the first full study of the symmetric cryptography in MTProto 2.0, Telegram's TLS. A variant of the protocol is proven secure in a formal model, but the authors also present two attacks on the specification and two on the implementation: timing channels in three official clients for plaintext recovery, and a server key-exchange flaw that enables man-in-the-middle attacks.
Why it matters. Messaging apps also used for work can have concrete cryptographic weaknesses: choosing them on verified protocols pays off.
6. Charge It to My Neighbor: A Relay Attack on ISO 15118 Plug and Charge Payment
arXiv · Jakob Löw, Vishwa Vasu, Thomas Hutzelmann, Hans-Joachim Hof · Cryptography
In short: A fake charging station lets attackers charge their own EV while billing another driver.
ISO 15118, Europe's leading standard for fast charging, lets electric vehicles pay automatically with contract certificates. The attack plugs the victim's car into a fake station and relays its authentication to a real station, which charges the attacker's car and bills the victim. It exploits the lack of station identity in the signature and weak TLS certificate handling.
Why it matters. As plug-and-charge spreads, payment fraud like this can hit fleets and charging operators before the standard is fixed.
7. Breaking Isolation: A New Perspective on Hypervisor Exploitation via Cross-Domain Attacks
Network and Distributed System Security Symposium · Gaoning Pan, Yiming Tao, Qinying Wang, Chunming Wu et al. · Systems & Software Security
In short: By reusing guest memory, cross-domain attacks make QEMU and VirtualBox hypervisor bugs exploitable.
Memory flaws in hypervisors are severe but hard to exploit, because useful structures are rare and hidden by address randomisation. The authors note that guest memory, controlled by the attacker, is reachable from the host and use it as a foothold. An automated system builds complete exploit chains: across 15 real QEMU and VirtualBox vulnerabilities the approach proves widely applicable.
Why it matters. A virtual machine escape hits every customer sharing the same host: a classic cloud accumulation risk.
8. Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications
IEEE Symposium on Security and Privacy · Giada Stivala, Rafael Mrowczynski, Maria V. Hellenthal, Giancarlo Pellegrino · Systems & Software Security
In short: Twenty-four hosting providers explain why vulnerability notifications lead to so few fixes.
Large-scale vulnerability notifications achieve few fixes. The authors interview 24 shared-hosting providers: nearly all receive and handle notifications, but treat web application flaws as the customer's responsibility. Low fees and a high volume of daily compromises discourage proactive action, and providers blame website owners.
Why it matters. Small businesses on shared hosting cannot count on the provider to fix flaws: the responsibility stays with them.
9. Breaking the illusion: Automated Reasoning of GDPR Consent Violations
IEEE Symposium on Security and Privacy · Ying Li, Wenjun Qiu, Faysal Hossain Shezan, Kunlin Cai et al. · Privacy
In short: Cosmic finds GDPR consent violations in 94.1% of web forms analysed across 5,823 sites.
GDPR and CCPA require informed, freely given, specific and unambiguous consent, yet research has mostly examined cookie banners. Cosmic automatically audits the web forms that collect consent: across 5,823 sites and 3,598 forms it detects 3,384 violations in 94.1% of forms, from consent not freely given to missing purpose and withdrawal information, with a 99.1% true-positive rate.
Why it matters. Consent violations are widespread and now automatically detectable: the risk of privacy fines for company websites grows.
Trends of the month
AI & LLM Security
277 papers this month on this topic
With 277 of 1,532 papers, AI security remains the top topic. Attacks on agents grow more realistic: poisoned memories that outlive the session, injections that work from one source in a hundred and prompts that exhaust a service's resources. At the same time, a review of 72 papers shows many results on LLMs in security should be read with caution.
Papers cited:
- MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
- ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data
- ThinkTrap: Denial-of-Service Attacks against Black-box LLM Services via Infinite Thinking
- Chasing Shadows: Pitfalls in LLM Security Research
Cryptography
176 papers this month on this topic
Two everyday protocols show concrete weaknesses. Telegram's MTProto, though proven secure in a formal variant, gives way to timing channels in clients and a flaw in the servers' key exchange, while electric-vehicle plug-and-charge lets an attacker bill another driver through a fake charging station.
Papers cited:
- Four Attacks and a Proof for Telegram
- Charge It to My Neighbor: A Relay Attack on ISO 15118 Plug and Charge Payment
Systems & Software Security
48 papers this month on this topic
Two risks emerge in shared infrastructure. Guest memory becomes a foothold for exploiting hypervisor bugs and breaking isolation, and shared-hosting providers leave reported flaws to their customers to fix. In both cases a single weak point can affect many customers at once.
Papers cited:
- Breaking Isolation: A New Perspective on Hypervisor Exploitation via Cross-Domain Attacks
- Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1532.