Modern agentic systems allow Large Language Model (LLM) agents to tackle complex tasks through extensive tool usage, forming structured control flows of tool selection and execution. Existing security analyses often treat these control flows as ephemeral, one-off sessions, overlooking the persistent influence of memory. This paper identifies a new threat from Memory Control Flow Attacks (MCFA) that memory retrieval can dominate the control flow, forcing unintended tool usage even against explicit user instructions and inducing persistent behavioral deviations across tasks. To understand the impact of this vulnerability, we further design MEMFLOW, an automated evaluation framework that systematically identifies and quantifies MCFA across heterogeneous tasks and long interaction horizons. To evaluate MEMFLOW, we attack state-of-the-art LLMs, including GPT-5 mini, Claude Sonnet 4.5 and Gemini 2.5 Flash on real-world tools from two major LLM agent development frameworks, LangChain and LlamaIndex. The results show that in general over 90% trials are vulnerable to MCFA even under strict safety constraints, highlighting critical security risks that demand immediate attention.

翻译：现代智能体系统允许大型语言模型（LLM）智能体通过广泛使用工具来处理复杂任务，形成结构化的工具选择与执行控制流。现有安全分析常将这些控制流视为短暂、一次性的会话，忽视了记忆的持久性影响。本文揭示了一种新型威胁——记忆控制流攻击（MCFA），即记忆检索可能主导控制流，迫使其使用非预期的工具（即便违反明确的用户指令），并引发跨任务的持续性行为偏差。为深入评估该漏洞的影响，我们进一步设计了MEMFLOW自动化评估框架，该系统化地识别并量化异构任务与长交互跨度中的MCFA。为验证MEMFLOW，我们对包括GPT-5 mini、Claude Sonnet 4.5和Gemini 2.5 Flash在内的前沿LLM展开攻击，测试工具来自LangChain和LlamaIndex两大主流LLM智能体开发框架。结果表明，即使在严格的安全约束下，超过90%的测试案例仍易受MCFA影响，这凸显了亟待关注的关键安全风险。