Delayed Execution Risk

Delayed execution risk is an AI-agent security failure mode where the dangerous effect does not happen in the same interaction that introduced the attacker influence. Instead, low-trust or mixed-trust content is written into durable state first — memory, summaries, task queues, schedules, approval caches, connector defaults, or child-agent output — and only later re-enters a higher-authority execution path.

This term matters because many AI security reviews still focus on prompt injection as if the attack must succeed in one session. That mental model breaks down for long-lived agents. Persistent systems keep context across time, replay model-authored plans, and execute deferred work under different conditions. An attacker may only need to plant a small change in remembered state on day one, then wait for a later run where the agent has stronger tools, stale approvals, weaker operator attention, or direct financial authority.

Delayed execution risk is closely related to prompt-to-sink, but it adds time and persistence to the path. The exploit chain is often better described as prompt-to-memory-to-queue-to-sink or prompt-to-summary-to-approval-to-sink. That makes the issue especially important in coding agents, long-lived autonomous workers, and Agentic DeFi systems where historical state can later shape shell execution, outbound messages, or wallet actions.

For auditors, the term is useful because it creates a concrete review checklist. You need to identify which persistence layers low-trust inputs can reach, whether provenance survives summarization, whether standing approvals are invalidated when context changes, and whether the final sink performs independent validation on the exact action being executed. You also need logs that preserve the entire delayed chain, not just the first prompt and the final side effect.

In practice, delayed execution risk is what turns memory poisoning, scheduler abuse, queue manipulation, and stale approvals from “workflow weirdness” into a security issue with real blast radius. It is one of the most important concepts for manual auditing of long-lived AI systems.