AI Agent Memory Poisoning

An attacker inserts malicious, misleading, or unauthorized information into an AI agent's persistent memory so the poisoned content influences future reasoning, tool use, decisions, and actions across subsequent sessions or users.

AI Agent Memory Poisoning targets the persistent memory mechanisms used by AI agents to retain information beyond a single interaction.

Agent memory can store user preferences, prior observations, task history, learned instructions, retrieved knowledge, workflow state, tool results, and other information intended to improve future behavior.

Persistence also creates an attack surface.

If untrusted information is written into long-term memory without sufficient validation, an attacker may be able to influence the agent after the original malicious interaction has ended.

For example, poisoned memory could instruct an agent to prefer an attacker-controlled resource, treat a malicious domain as trusted, modify future tool parameters, disclose information under certain conditions, or reinterpret subsequent legitimate requests.

Unlike conventional prompt injection, the malicious instruction does not necessarily disappear when the conversation ends.

The result is a form of AI persistence:

Injection → Memory Write → Session Ends → Memory Retrieved → Future Behavior Manipulated

An attacker identifies an AI agent capable of retaining information between interactions.

The attacker supplies malicious content through a conversation, document, email, webpage, RAG source, tool response, agent message, or another input accessible to the system.

The agent interprets some portion of the attacker-controlled information as useful knowledge and stores it in persistent memory.

The initial session may then terminate.

During a later interaction, the agent retrieves the poisoned memory because it appears relevant to the current task.

The stored information enters the agent’s reasoning context and influences subsequent behavior.

Depending on the agent’s capabilities, this may alter responses, redirect workflows, manipulate tool calls, expose information, influence other agents, or create a persistent foothold in automated business processes.

1. Memory Surface Discovery
The attacker determines that the target agent retains information across sessions.

2. Malicious Input Delivery
Attacker-controlled content is introduced through a supported input channel.

3. Memory Write Influence
The agent is manipulated into classifying the malicious information as worthy of persistent storage.

4. Persistent Storage
The poisoned information is written into long-term memory, a vector store, user profile, knowledge store, workflow state, or similar persistence mechanism.

5. Dormancy
The original interaction ends while the malicious state remains stored.

6. Memory Retrieval
A future task causes the stored information to be retrieved.

7. Context Reinjection
The poisoned memory becomes part of the agent’s active reasoning context.

8. Behavioral Manipulation
The agent changes its reasoning, tool selection, data handling, or actions based on the poisoned state.

9. Continued Persistence
Successful behavior may reinforce, rewrite, or propagate the malicious memory.

• Enterprise AI agents
• Persistent-memory agents
• Personal AI assistants
• Coding agents
• Customer-service agents
• RAG-enabled agents
• Autonomous workflow systems
• Agent orchestration platforms
• Shared-memory multi-agent systems
• Vector databases
• Long-term conversation stores
• User-profile memory
• CRM-connected agents
• Email assistants
• SaaS-integrated agents
• MCP-enabled agents
• AI knowledge-management systems

Persistent memory changes the security consequences of a successful AI attack.

A conventional malicious prompt may influence an agent for one interaction. A successful memory-poisoning attack can potentially alter behavior long after the attacker disappears.

That creates a persistence mechanism that may be difficult for conventional security tools to recognize.

The underlying infrastructure can remain uncompromised. No malware needs to execute, no operating-system persistence mechanism needs to exist, and the user’s account may remain completely legitimate.

The compromised state exists inside what the AI believes it has learned.

For enterprises deploying agents into long-running workflows, this creates an important offensive-testing question:

Can untrusted information introduced today become trusted instructions that influence what your AI agents do tomorrow?

Testing persistent memory should therefore be a core component of enterprise agent security assessments.

Authorized testing should evaluate what the agent is allowed to remember, who can influence that memory, and how stored information affects future behavior.

Testing should include:

• Attempting to store attacker-controlled instructions
• Injecting malicious content through indirect sources
• Testing memory persistence across sessions
• Determining whether memory survives authentication changes
• Testing cross-user memory isolation
• Testing cross-tenant memory isolation
• Inserting false trust relationships
• Attempting to store attacker-controlled URLs
• Poisoning remembered tool preferences
• Manipulating stored workflow instructions
• Attempting to overwrite legitimate memory
• Testing whether untrusted tool output enters persistent memory
• Evaluating memory provenance
• Testing memory expiration and revocation
• Determining whether poisoned memory influences privileged actions
• Testing propagation into other agents
• Evaluating whether users can inspect and delete stored memory

A particularly important test is separating:

Data the agent may remember

from:

Instructions the agent is permitted to execute later.

Persistent data should never silently become persistent authority.

Monitor for:

• Unexpected long-term memory writes
• Large increases in memory creation
• Instructions stored as user facts or preferences
• New external domains appearing in memory
• Security-sensitive information entering persistent stores
• Memory changes following untrusted document retrieval
• Agent behavior changing across sessions
• Repeated retrieval of unusual memory entries
• Memory entries without clear provenance
• Cross-user memory retrieval
• Tool behavior influenced by historical content
• Unexpected modification of trusted preferences
• Persistent instructions referencing credentials or secrets
• Memory created by indirect content
• Agent actions traceable to old or unrelated sessions

AI Agent Memory Poisoning does not map cleanly to a single conventional ATT&CK technique because the vulnerable persistence mechanism exists inside the AI system. Depending on the resulting behavior, relevant concepts can include: T1098 — Account Manipulation T1546 — Event Triggered Execution T1556 — Modify Authentication Process T1078 — Valid Accounts These should only be applied when the actual resulting behavior matches the technique. MITRE ATLAS is the more appropriate framework for adversarial behavior directly targeting AI and ML systems.

Relevant OWASP agentic-security concerns include: Memory & Context Poisoning Agent Goal Hijacking Tool Misuse & Exploitation Agentic Supply Chain / Trust Risks The attack can also originate through indirect prompt injection, where malicious external content causes the agent to retain attacker-controlled information.