Agent memory and context poisoning

What it is

Agents keep state: saved preferences, summaries of earlier conversations, notes to themselves, shared stores that several agents read. Poisoning is the planting of content there so that it influences future behaviour. It differs from prompt injection, which acts within one interaction, by persisting after the interaction ends, and from retrieval corpus poisoning by targeting what the agent itself wrote down.

How it happens

• An injected instruction asks the agent to "remember" a rule for future use.
• A false fact is repeated until the agent records it in a summary.
• One user's session writes to a store that other users' sessions read.
• An attacker with access to the memory store edits it directly.

Why it matters

The effect is delayed and detached from its cause. The session that shows the harm contains no hostile input, so investigation of that session finds nothing. Every user who shares the memory is affected.

Warning signs

• Memory entries have no record of when or why they were written.
• Agent behaviour changes between sessions with no release.
• Stored memories contain instructions where facts are expected.
• Nobody can list or clear what an agent remembers.

Who owns it

Engineering owns the memory design and its write controls. The data owner is accountable for what may be retained. Security monitors for tampering.

In practice

A customer tells a banking assistant that, for accessibility reasons, it should always skip the security questions for them, and the assistant stores this as a preference. Later sessions on that profile, including one opened by someone else, start without verification. The same pattern generalises to any agent that writes its own long-term memory from conversation.