Magnet: Detecting Cross-Session AI Misuse Through C... | AI Research

Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulation addresses the risk of attackers using multiple, isolated AI agent sessions to assemble harmful capabilities that would be blocked if requested in a single conversation. By decomposing a malicious goal into individually benign subtasks, an attacker can bypass traditional safety guardrails that only monitor single-session interactions. Authors Natalie Isak and Matthew Dressman propose Magnet, a detection system that tracks the accumulation of these sub-capabilities across a user’s entire history rather than evaluating each session in isolation.

The Problem: Cross-Session Evasion

Current AI abuse detection systems typically focus on single-turn or multi-turn conversations. This leaves a gap because AI agents are stateless between sessions, while the attacker is not. An attacker can distribute parts of a harmful objective—such as creating a phishing kit or a weapon—across many independent sessions. Because each individual request appears innocuous, standard safety filters fail to identify the emerging threat. The authors found that as attacks move from single-turn to multi-session delivery, the success rate of eliciting harmful artifacts increases, as the model’s safety guardrails are less likely to recognize the intent when the full attack chain is hidden across different context windows.

How Magnet Works

Magnet shifts the focus from detecting "intent" to tracking "capability." Intent is often masked by prompt engineering or benign framing, making it a fragile signal for detection. Instead, Magnet monitors the concrete artifacts produced by an agent, such as tool-call results and model responses.
The system uses an expert-authored taxonomy of capabilities required for specific harmful objectives. Each session is represented as a binary vector of these capabilities. Magnet aggregates these vectors for a specific user ID using a bitwise OR operation. This approach is monotonic, meaning it permanently retains evidence of each new component an attacker acquires. Once a user’s accumulated inventory meets a specific threshold for a known attack category, the system flags the activity. This provides an interpretable verdict, such as identifying that a user has successfully gathered a specific number of components required for a prohibited goal.

Findings and Performance

The authors tested this approach by simulating goal decomposition across nine different AI models. They observed that the average attack success rate rose from 18.7% for single-turn requests to 37.4% for multi-session deliveries. By comparing these results, the researchers identified that the decline in model refusals in multi-session settings is a primary driver of the detection gap. The study confirms that while some models are more resistant to this technique than others, the vulnerability is widespread enough to necessitate entity-level monitoring that persists across session boundaries.

Limitations and Scope

The authors note several boundaries to their research. Magnet currently correlates activity based on a single user ID and assumes a non-adaptive attacker who does not attempt to fragment their activity across multiple accounts or IP addresses. The study also assumes that all subtasks are routed through the same model family, rather than using a mix of models to potentially optimize the attack. Furthermore, the researchers do not claim that Magnet provides full coverage for all possible attack types, nor does it account for memory systems that might link sessions together, as such systems would fundamentally change the assumption that sessions are independent.