Persistent state is information an agent saves between sessions so it can resume work later. In agent systems, this can include memory files, logs, prompt files, task notes, or other writable artifacts that are reloaded when the next run starts. It matters because persistence extends trust beyond a single chat: if saved content is treated as instruction instead of data, a bad or tampered file can influence future behavior.
In attacks, persistent state can become a delivery path for prompt injection or self-propagating payloads. A compromised memory file may be reloaded as if it were legitimate context, letting hostile instructions survive a reset and spread to other agents or sessions. Defenses focus on treating persisted content as untrusted input, separating instructions from data, validating what gets reloaded, restricting write access, and isolating state that should not control execution.