Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents

A security paper introduces “sleeper channels,” where untrusted input enters one agent surface and later activates through a different one in an always-on autonomous agent.

The authors show the problem in OpenClaw with a cron-based confused-deputy attack, highlighting how persistent processes can carry prompt injections forward over time.

To defend against this class of attack, the paper proposes tiered provenance-based protections, including canonical action-instance digests and owner attestations.

The work adds a new threat model for agentic systems and provides a formalized safety layer for more secure deployment.