What's this about?
Self-hosted AI agents constantly read and write their own memory and configuration files to function — which means an attacker who can corrupt those files through entirely legitimate operating-system calls can compromise the agent without ever touching its model weights or "hacking" it in the traditional sense. The paper maps out a four-axis space of these "self-state attacks" and tests defenses against them.
What exactly is a "self-state attack"?
Think of an agent's memory/config files as its notebook — its sense of what it has done, what its goals are, and what tools it can use. A self-state attack doesn't break into the notebook through a locked door; it just legitimately writes something false into it, the way a legitimate OS file-write can quietly change what an agent believes about itself. Because the write operation itself is completely normal (nothing "hacked"), it's hard for conventional security tools to flag.
Why does it matter?
The paper finds a layered defense stack handles most attack combinations, but a residual sliver of attacks remains structurally indistinguishable from legitimate agent self-modification at the OS level — meaning this is a category of vulnerability that current tooling fundamentally cannot fully close, not just one that needs a patch.