Jie M. Zhang

Yechao Zhang, Shiqian Zhao, Jiawen Zhang et al.

Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, in which a remote black-box adversary delivers a single email payload that must induce the agent to write poisoned memory, stay hidden in the agent's response to the user, and affect future behavior. We introduce WhisperBench, a 108-case benchmark spanning five risk categories and both fact and preference poisoning. Built on a real IMAP/SMTP workflow and an authentic email agent skill, it enables full-cycle evaluation of stealth memory injection attacks. To enable this black-box attack under single-email delivery and without runtime feedback, we propose MemGhost, a one-shot payload generation framework. MemGhost uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0), and remains effective against input-level, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.

Xinjian Wu, Jingzhi Gong, Gunel Jahangirova et al.

As Large Language Model (LLM) agents become integral to modern software systems, ``skills'' have emerged as a novel unit of software reuse, enabling developers to package workflows, decision procedures, and prompt-based policies. While skills are intended for reuse, downstream developers frequently modify published skills to fit local contexts, yet little is known about the nature of such adaptations. This paper presents the first empirical study of downstream skill adaptation in public forks, to understand how published skills are adapted, and to provide implications for researchers and engineers on improving skill design, evolution, and orchestration. Specifically, we analyze 1,126 skill-adaptation instances from six widely adopted skill repositories and develop a taxonomy comprising 46 adaptation patterns organized into 13 families. Our key findings reveal a reuse paradox: although skills are intended to be easily imported and reused, developers spend a lot of effort rewriting what the skills do, fixing skill discoverability, and translating them for different tools and languages, indicating a need for better abstractions, standardized interfaces, and automated support for skill adaptation. Furthermore, adaptations are highly interdependent, with changes in one component often requiring coordinated updates elsewhere, motivating automated support for detecting inconsistent modifications. We also find that nearly one-fifth of adaptations introduce security-sensitive content within the same instruction text that governs behavior.

Haofan Cheng, Jingjing Hu, Jingrong Pei et al.

Electroencephalography (EEG) offers a noninvasive approach for examining neurophysiological correlates of dimensional psychopathology, yet systematic evidence across EEG paradigms and feature granularities remains limited. Here, we develop a granularity-aware EEG feature pipeline that organizes multi-scale descriptors into global, regional, and channel levels. Using the Healthy Brain Network (HBN) cohort, we evaluate the prediction of four psychopathology dimensions: p-factor, internalizing, externalizing, and attention problems, across four EEG paradigms. Given the heterogeneity of pediatric psychopathology and the moderate reliability of questionnaire-derived scores, this setting represents a challenging feasibility test rather than a clinical screening scenario. Tree-based models and granularity-balanced feature selection showed promising improvements over conventional approaches in selected conditions, although effect sizes remained modest. Visualization of selected markers revealed dimension-specific spatial and spectral patterns that were broadly aligned with existing neurophysiological knowledge. An exploratory cross-dataset sanity check on the independent PEARL cohort suggested that the proposed selection principle remains technically feasible under protocol shifts, without claiming cross-dataset generalizability. Overall, multi-scale EEG features contain weak but detectable signals related to dimensional psychopathology, and granularity-aware selection may serve as a useful feature-reduction strategy for future EEG-based phenotyping studies.