← Back to Library

Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution

Authors: Yechao Zhang, Shiqian Zhao, Jie Zhang, Gelei Deng, Jiawen Zhang, Xiaogeng Liu, Chaowei Xiao, Tianwei Zhang

Published: 2026-03-24

arXiv ID: 2603.23064v2

Added to Library: 2026-03-26 02:02 UTC

📄 Abstract

We identify a critical security vulnerability in mainstream Claw personal AI agents: untrusted content encountered during heartbeat-driven background execution can silently pollute agent memory and subsequently influence user-facing behavior without the user's awareness. This vulnerability arises from an architectural design shared across the Claw ecosystem: heartbeat background execution runs in the same session as user-facing conversation, so content ingested from any external source monitored in the background (including email, message channels, news feeds, code repositories, and social platforms) can enter the same memory context used for foreground interaction, often with limited user visibility and without clear source provenance. We formalize this process as an Exposure (E) $\rightarrow$ Memory (M) $\rightarrow$ Behavior (B) pathway: misinformation encountered during heartbeat execution enters the agent's short-term session context, potentially gets written into long-term memory, and later shapes downstream user-facing behavior. We instantiate this pathway in an agent-native social setting using MissClaw, a controlled research replica of Moltbook. We find that (1) social credibility cues, especially perceived consensus, are the dominant driver of short-term behavioral influence, with misleading rates up to 61%; (2) routine memory-saving behavior can promote short-term pollution into durable long-term memory at rates up to 91%, with cross-session behavioral influence reaching 76%; (3) under naturalistic browsing with content dilution and context pruning, pollution still crosses session boundaries. Overall, prompt injection is not required: ordinary social misinformation is sufficient to silently shape agent memory and behavior under heartbeat-driven background execution.

🔍 Key Points

  • The paper introduces the Tree-structured Injection for Payloads (TIP) framework, a novel black-box attack method designed to exploit the Model Context Protocol (MCP) in large language models (LLMs).
  • TIP generates stealthy injection payloads through a tree-structured adaptive search method that prioritizes semantic coherence and adversarial effectiveness, allowing it to surpass existing techniques in attack success rates and efficiency.
  • Extensive experiments demonstrate that TIP achieves over 95% attack success rates in undefended settings and maintains over 50% effectiveness against state-of-the-art defense mechanisms, highlighting a significant vulnerability in the MCP ecosystem.
  • The authors emphasize the practical implications of their findings, exposing real-world security risks associated with tool-augmented LLMs and stressing the urgent need for improved defenses against such attacks.
  • A case study illustrates the effectiveness of TIP in real-world scenarios, showcasing its ability to exploit the inherent trust placed in third-party tools and the consequences of such vulnerabilities.

💡 Why This Paper Matters

This paper is highly relevant as it uncovers critical vulnerabilities in the integration of large language models with external tools through the Model Context Protocol. The proposed TIP framework not only highlights the ease with which adversaries can manipulate these systems but also reveals the inadequacies of current defense mechanisms, necessitating urgent improvements in AI security protocols.

🎯 Why It's Interesting for AI Security Researchers

The findings of this study are of significant interest to AI security researchers as they highlight an underexplored attack vector in LLMs, demonstrating the potential for real-world exploitation of tool-augmented systems. The empirical results and advanced methodologies presented in the paper provide valuable insights for developing more robust defenses and understanding adversarial behaviors in AI systems.

📚 Read the Full Paper

📄 View on arXiv 📎 Download PDF