What's this about?
LLMs have moved from generating text to driving embodied agents through in-context learning, task decomposition, step-by-step reasoning and code generation. This paper shows that the persistent world state those agents operate over becomes an injection vector — state-semantic injection.
What exactly is state-semantic injection?
Prompt injection puts malicious instructions in text the model reads. State-semantic injection puts them in the *situation*. An embodied agent perceives its environment and builds a semantic description of it — "there is a box labelled X on the table." If an attacker controls something in the environment, they control part of that description, and the agent reasons over it as fact. The physical world becomes an untrusted input channel. Unlike a poisoned document you could in principle scan, you cannot sanitize a room.
Why is this worth noticing?
- It's the embodied counterpart to OpenART's finding that evolving environment state defeats agents that resist prompt-based attacks — the same insight arriving in robotics.
- It matters more here because the consequences are physical, and because the attack surface is anything the agent can perceive.
- It fits today's pattern precisely — Copilot's injection through an issue title, CompoSkill's chained skills, and this: the input the system didn't think of as input.