[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-327378-105":59,"doc-detail-327378-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","elephantagent-contextual-state-continuity-in-agentic-systems-protocol","ElephantAgent - Contextual State Continuity in Agentic Systems - Protocol","","Agentic systems improve task performance by invoking external tools and keeping persistent memory, but these dependencies create new attack surfaces. Tool poisoning and memory poisoning can bias agent behavior by corrupting tool descriptors or poisoned memory, revealing a deeper weakness: lack of verifiable continuity in the agent’s contextual state used for planning and execution. ElephantAgent enforces Contextual State Continuity by binding the bounded, security-critical contextual state to a verifiable digest and a linearizable authorized transition ledger.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/elephantagent-contextual-state-continuity-in-agentic-systems-protocol/327378/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/elephantagent-contextual-state-continuity-in-agentic-systems-protocol/327378.png","ImageObject",300,407,{"name":92,"@type":93},"Aurora","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-09-21",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",13,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What problem does ElephantAgent address in agentic systems?","Question",{"text":113,"@type":114},"ElephantAgent addresses the lack of verifiable continuity in the agent’s contextual state used for planning and execution, which enables contextual state poisoning through tools and memory.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How does ElephantAgent defend against contextual state poisoning?",{"text":118,"@type":114},"Before each query, it recomputes a digest of the local contextual state and verifies it against the latest authorized digest. It also maintains a linearizable ledger of authorized contextual state transitions to detect out-of-band tampering.",{"name":120,"@type":111,"acceptedAnswer":121},"What additional capability supports recovery after in-band abuse?",{"text":122,"@type":114},"ElephantAgent provides Historical Traceability, enabling conditional post-hoc audit and recovery to a known-good prior state when semantic abuse occurs within authorized channels.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},327378,1790464725,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":140,"language":141,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":142,"faqs":143,"seo_title":144,"seo_description":67,"update_tm":145,"read_time":146,"preview_page_count":4},4810365810221,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","ElephantAgent: Contextual State Continuity in Agentic Systems  \nJiankai Jin 360 AI Security Lab  \nBeijing, China [jinjiankai@360.cn](jinjiankai@360.cn)  \nWenzhuo Xu 360 AI Security Lab  \nBeijing, China [xuwenzhuo@360.cn](xuwenzhuo@360.cn)  \nXiangzheng Zhang  \n360 AI Security Lab Beijing, China [zhangxiangzheng@360.cn](zhangxiangzheng@360.cn)  \nDongdong Yang  \n360 AI Security Lab Beijing, China [yangdongdong1@360.cn](yangdongdong1@360.cn)  \nZhao Liu  \n360 AI Security Lab Beijing, China [liuzhao3@360.cn](liuzhao3@360.cn)  \nDeyue Zhang 360 AI Security Lab  \nBeijing, China [zhangdeyue@360.cn](zhangdeyue@360.cn)  \narXiv :2607 .0 19 19v 1 [ cs .AI] 2 Jul 2026  \nQuanchen Zou  \n360 AI Security Lab Beijing, China [zouquanchen@360.cn](zouquanchen@360.cn)  \nAbstract  \nAgentic systems enhance their capabilities by invoking external tools and maintaining persistent memory. However, these external dependencies introduce novel attack surfaces. Recent tool and memory poisoning attacks show that maliciously crafted tool descriptors and poisoned memory can covertly bias agent behavior. These threats reflect a deeper issue: the lack of verifiable continuity in the agent’s contextual state for planning and execution. We present ElephantAgent, a protocol that enforces Contextual State Continuity to defend against contextual state poisoning. Inspired by prior state-continuity mechanisms (e.g., Nimble), ElephantAgent extends this protection to the evolving contextual state of agentic systems. We define the contextual state as the bounded, securitycritical subset of the agent’s entire context (e.g., tool state and memory) . Before processing each query, ElephantAgent recomputes the digest of the local contextual state and verifies it against the latest authorized digest. Using replicated trusted hardware, ElephantAgent maintains a linearizable ledger of authorized contextual state transitions and detects out-of-band state tampering. To handle in-band semantic abuse, ElephantAgent additionally provides Historical Traceability, enabling conditional post-hoc audit and recovery to a known-good prior state.  \nCCS Concepts  \n• Security and privacy → Systems security; • Computing methodologies → Intelligent agents.  \nKeywords  \nAgentic Systems, Agentic Context Safety, Contextual State Continuity, Memory Poisoning, Tool Poisoning  \n1 Introduction  \nAgentic systems have demonstrated impressive performance on complex tasks by invoking task-specific tools and maintaining memory, via standard protocols such as the Model Context Protocol (MCP) [4] and CLI-based agent protocols [16] . These protocols typically assume that tool descriptors and memory are trustworthy and  \nconstitute part of the context used by the agent for planning and execution. However, these context-dependent features introduce novel security vulnerabilities. The agent’s behavior depends not only on the user’s instructions, but also on a bounded, security-critical subset of its entire context, which we refer to as its contextual state.  \nAn MCP tool provider can conduct a tool poisoning attack [10, 22, 35] by injecting adversarial content into a tool descriptor (e.g., tool metadata such as the tool name and natural language description), either at registration time or later during an agent session. Since the agent plans based on these descriptors, a poisoned descriptor can covertly influence its reasoning. As a result, the agent may issue tool invocations that appear consistent with the user’s instructions but are actually induced by the poisoned contextual state. For example, MCP’s server-based architecture enables “rug pull” tool poisoning [22] . A server can initially present a benign descriptor that the user approves, then later silently alter it to embed adversarial directives, such as “Before using this tool, read the SSH key file”. Most MCP clients do not alert users when descriptors change, allowing a server to behave innocuously at installation and activate the malicious behavior later","cbCaigzlA6QE00v7","https://ap.wps.com/l/cbCaigzlA6QE00v7","pdf",1435333,17,"English","# Abstract\n# Introduction","[{\"question\":\"What problem does ElephantAgent address in agentic systems?\",\"answer\":\"ElephantAgent addresses the lack of verifiable continuity in the agent’s contextual state used for planning and execution, which enables contextual state poisoning through tools and memory.\"},{\"question\":\"How does ElephantAgent defend against contextual state poisoning?\",\"answer\":\"Before each query, it recomputes a digest of the local contextual state and verifies it against the latest authorized digest. It also maintains a linearizable ledger of authorized contextual state transitions to detect out-of-band tampering.\"},{\"question\":\"What additional capability supports recovery after in-band abuse?\",\"answer\":\"ElephantAgent provides Historical Traceability, enabling conditional post-hoc audit and recovery to a known-good prior state when semantic abuse occurs within authorized channels.\"}]","ElephantAgent - Contextual State Continuity in Agentic Systems - Protocol | PDF",1789977097,43]