Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution

1. Problem Statement: Silent Memory Pollution

The paper identifies a critical architectural vulnerability in Claw systems (a family of persistent personal AI agents, e.g., OpenClaw). These agents utilize a heartbeat mechanism to perform background tasks (e.g., monitoring emails, news feeds, or social platforms) without explicit user prompts.

• The Core Flaw: Heartbeat execution runs in the same session context as user-facing conversations. Consequently, information ingested during background monitoring enters the agent's shared short-term memory (context window) alongside user interactions.
• The Threat: Unlike traditional prompt injection, this attack does not require malicious code or direct interaction with the agent. An adversary can simply post misinformation on a social platform or feed that the agent monitors.
• The Consequence: The agent silently absorbs this misinformation, potentially writes it into long-term memory (via routine "save" behaviors), and subsequently acts upon it in future user-facing sessions. The user remains unaware that the agent's "knowledge" has been corrupted by untrusted external sources.

The authors formalize this threat as an Exposure (E) → Memory (M) → Behavior (B) pathway.

2. Methodology

Experimental Platform: MissClaw

To evaluate this threat without exposing real users or agents to manipulation, the authors built MissClaw, an isolated research replica of Moltbook (a large-scale, agent-native social platform).

• Features: MissClaw replicates the full API surface of Moltbook (posting, voting, commenting, sub-communities) but operates in a controlled environment with deterministic content seeding and per-run isolation.
• Victim Agents: Five distinct OpenClaw agents were deployed with different personas (Cheerful, Bold, Curious, Wise, Skeptical) to test behavioral variance. All ran on the Claude Haiku 4.5 model.

Evaluation Protocol (The E→M→B Pathway)

The study was conducted in three progressive stages to test the persistence and impact of the pollution:

1. Study 1: Short-Term Influence (Same-Session)
   • Setup: Agents browse a manipulated post via heartbeat, then immediately receive a user query in the same session.
   • Variables: Tested the impact of Social Signals (Authority of the poster, Consensus of comments), Agent Persona, and External Search capabilities.
2. Study 2: Long-Term Persistence (Cross-Session)
   • Setup: Agents browse a manipulated post, engage in filler tasks, receive a "save" prompt (ranging from casual hints to explicit instructions), and then the session is reset. A new session begins with a downstream task.
   • Goal: Determine if short-term pollution is promoted to long-term memory and influences behavior across session boundaries.
3. Study 3: Realistic Conditions (Content Dilution)
   • Setup: The manipulated post is embedded in a feed of 20 benign posts (1-in-20 ratio) to simulate naturalistic browsing. The system's context pruning mechanisms are active.
   • Goal: Test if the attack survives content dilution and context management.

Domains

Experiments covered three domains:

• Software Security: Recommending vulnerable library versions.
• Financial Decision-Making: Selecting DeFi protocols with hidden risks.
• Academic References: Citing fabricated papers.

3. Key Contributions

1. Identification of a Zero-Click Attack Surface: The paper reveals that heartbeat-driven background execution in shared-session architectures creates a "zero-click" vector for memory pollution. The user does not need to click a link or read a message; the agent's routine background activity is sufficient.
2. Formalization of the E→M→B Pathway: The authors define a specific attack chain where external exposure leads to memory contamination, which subsequently alters downstream behavior, distinct from direct prompt injection.
3. Empirical Validation via MissClaw: The construction of MissClaw allows for the first controlled, end-to-end measurement of how social misinformation transitions into persistent agent states.
4. Analysis of Mitigation Factors: The study systematically evaluates the roles of social credibility, persona, memory-saving triggers, and context pruning, providing concrete data on what amplifies or mitigates the risk.

4. Key Results

Study 1: Factors Driving Influence

• Social Credibility is Dominant: Perceived consensus (comments agreeing with the post) is the strongest driver of influence, more so than the authority of the poster.
  • Result: With both authority and consensus present, the Attack Success Rate (ASR) reached 61% on average.
  • Insight: Attackers can manufacture consensus using multiple low-level accounts, bypassing the need for high-authority accounts.
• Persona Matters: "Skeptical" personas were significantly more resilient (ASR ~11-16%), while "Bold" and "Cheerful" personas were highly vulnerable (ASR ~58-61%).
• External Search is Ineffective: Providing agents with web search tools did not reliably prevent the influence. Agents often failed to invoke search or trusted the socially ingested content over search results.

Study 2: Long-Term Memory Pollution

• Routine Saves Promote Pollution: Standard user requests to "save notes" inadvertently write poisoned content into long-term memory.
  • Result: Under strong save prompts (S4), 91.1% of manipulated content was saved to long-term memory.
• Cross-Session Influence: Once saved, the pollution persisted across session resets.
  • Result: The cross-session ASR reached 75.6% (without search) and 42.2% (with search).
  • Domain Specifics: Financial and Academic domains were most vulnerable to long-term pollution.

Study 3: Resilience Under Dilution

• Dilution Reduces but Does Not Eliminate Risk: Even when the manipulated post was 1 of 20 benign posts, the attack remained effective.
  • Result: Save rates dropped to 28.9% (vs. 91.1% in Study 2), and cross-session ASR dropped to 17.8%.
  • Significance: Despite context pruning and noise, the agent still absorbed and acted on the misinformation in a significant minority of cases.

5. Significance and Implications

• Architectural Vulnerability: The threat is not a bug in a specific model but a consequence of the shared-session design common in persistent agent frameworks (Claw ecosystem).
• Shift in Threat Model: Security defenses currently focus on prompt injection and direct tool misuse. This paper argues that passive social ingestion is a viable and potent attack vector that bypasses these defenses because the content appears as "ordinary information" rather than a malicious command.
• Source Monitoring Failure: The results mirror human psychological phenomena (e.g., the misinformation effect and source monitoring failure), where agents lose the provenance of information, treating social rumors as internal knowledge.
• Recommendations: The authors suggest that future agent designs must implement:
  • Isolated Heartbeat Contexts: Running background tasks in separate memory spaces.
  • Provenance Tracking: Explicitly tagging memory entries with their source (e.g., "from background feed").
  • Visibility: Giving users visibility into what the agent is processing in the background.
  • Strict Memory Gates: Requiring higher confidence or user confirmation before writing background-derived data to long-term memory.

In conclusion, the paper demonstrates that ordinary social misinformation is sufficient to silently corrupt the "mind" of persistent AI agents, fundamentally challenging the trustworthiness of autonomous agents operating in shared-session environments.