# MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents

Source: [MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents](<https://www.sota2.com/research/paper/6a28f37790966ade919c19a9>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-06-11T05:00:14.404Z

Authors: Yv Zhang, Hao Sun, Hao Fang, Kuofeng Gao, Fan Mo, Bin Chen, Shu-Tao Xia, Yaowei Wang

Published: 2026-06-09T11:53:25.000Z

## Abstract

External memory has become a core component of modern web agents, enabling long-horizon reasoning through the retrieval of past experiences. However, this paradigm introduces a critical vulnerability: malicious content injected into memory can be persistently recalled and repeatedly influence agent behavior. In this work, we identify and systematically study multimodal memory poisoning, an overlooked yet practical attack surface in web-agent systems. We propose MemVenom, a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence. Our method consists of a two-stage design: (1) a trigger-conditioned retrieval attack that ensures high-probability recall of malicious memory, and (2) a post-retrieval attack induction that leverages adversarial perturbations and stealthy OCR injection to override the original user objective. Unlike prior attacks that operate on prompts or text-only memory, our approach enables persistent, reusable, and goal-agnostic attacks without modifying model parameters or re-optimizing malicious tasks. Experiments across multiple web-agent frameworks and vision-language models demonstrate that MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents, while transferring effectively across architectures and model scales.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Multimodal memory poisoning attack on SeeAct](<https://www.sota2.com/research/sota/multimodal-memory-poisoning-attack-on-seeact.md>): Multimodal memory poisoning attack; SeeAct; ASR-r: 99.15.

- [Multimodal memory poisoning attack on ReAct](<https://www.sota2.com/research/sota/multimodal-memory-poisoning-attack-on-react.md>): Multimodal memory poisoning attack; ReAct; ASR-r: 97.32.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2606.10742>)

[PDF](<https://arxiv.org/pdf/2606.10742.pdf>)