For Heads-of · Practitioner
Memory Poisoning
Also known as: agent memory poisoning
Corrupting what an AI agent remembers or retrieves, so that later sessions, possibly other users' sessions, behave as the attacker wants. Unlike a one-off prompt injection it persists, and OWASP lists it among the top risks for agentic applications (ASI06).
- AI agents
- ASI06
- context poisoning
- agent memory
- persistence
How it works
Agents increasingly keep memory between sessions: notes, preferences, summaries of past tasks, or documents added to a shared knowledge store. If an attacker can get content into that memory, through a document the agent reads, a conversation it summarises or a tool that writes to it, the content shapes every later run that recalls it. One successful injection becomes a standing one.
Why it is harder than ordinary injection
The malicious instruction is no longer in front of anyone. It sits in a store that users treat as the agent's own knowledge, it can affect people who never saw the original content, and it survives until someone finds and removes it. Detection depends on being able to inspect what the agent has stored.
Controls
Treat agent memory as a write-controlled store: limit what can be written and by whom, record where each memory came from, let administrators inspect and purge it, and expire it. Keep memory separate between users unless sharing is deliberate. The register entries are data and model poisoning and vector and embedding weaknesses; vector store and embedding access controls is the nearest control.
Sources
Related Terms
Agent Goal Hijack
Redirecting an AI agent's objective or plan, usually by placing instructions in content the agent reads, so that it pursues the attacker's goal with its own tools and permissions. It is the agentic form of prompt injection and the first item in OWASP's Top 10 for Agentic Applications (ASI01).
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
Data Poisoning
An attack in which an adversary deliberately corrupts data an AI model learns from, to degrade it or plant hidden behaviour. It now reaches beyond training data to fine-tuning sets, retrieval corpora and agent memory, and a poisoned model can pass ordinary evaluation.
OWASP Top 10 for Agentic Applications
OWASP's list of the ten most critical security risks specific to autonomous AI agents, published in December 2025. It complements the OWASP Top 10 for LLM Applications by covering what only goes wrong when a model acts: hijacked goals, misused tools, poisoned memory and failures that cascade between agents.