Modern agentic systems allow Large Language Model (LLM) agents to tackle complex tasks through extensive tool usage, forming structured control flows of tool selection and execution. Existing security analyses often treat these control flows as ephemeral, one-off sessions, overlooking the persistent influence of memory. This paper identifies a new threat from Memory Control Flow Attacks (MCFA) that memory can dominate the control flow, forcing unintended tool usage even against explicit user instructions and inducing persistent behavioral deviations across tasks. To understand the impact of this vulnerability, we further design MEMFLOW, an automated evaluation framework that systematically identifies and quantifies MCFA across heterogeneous tasks and long interaction horizons. To evaluate MEMFLOW, we attack state-of-the-art LLMs, including GPT-5 mini, Claude Sonnet 4.5 and Gemini 2.5 Flash on real-world tools from two major LLM agent development frameworks, LangChain and LlamaIndex. The results show that in general over 90% of trials are vulnerable to MCFA even under strict safety constraints, highlighting critical security risks that demand immediate attention.

翻译：现代智能体系统允许大语言模型（LLM）智能体通过广泛工具使用处理复杂任务，形成工具选择与执行的层次化控制流。现有安全分析通常将这些控制流视为短暂的、单次会话，忽视了内存的持续性影响。本文识别出一种新型威胁——内存控制流攻击（MCFA），该攻击表明内存可主导控制流，迫使工具违背用户明确指令被调用，并诱导跨任务的持续性行为偏差。为理解该漏洞的影响，我们进一步设计了自动化评估框架MEMFLOW，该框架能系统性地识别和量化跨异构任务与长交互窗口的MCFA。为评估MEMFLOW，我们在来自两大主流LLM智能体开发框架LangChain和LlamaIndex的真实工具上，对包括GPT-5 mini、Claude Sonnet 4.5和Gemini 2.5 Flash在内的最先进LLM实施攻击。结果表明，即使在严格安全约束下，超过90%的试验仍易受MCFA攻击，凸显了亟需关注的重大安全风险。