Agent Memory Poisoning for Persistent Behavior Change
First seen Jul 3, 2026 · Updated Jul 3, 2026
Attackers seed false facts or standing instructions into an agent's long-term memory or RAG store, quietly steering decisions across future sessions long after the original malicious input is gone.
Technical Analysis
Agents that write summaries of conversations, tool outputs, or scraped pages into persistent memory will faithfully store attacker-supplied content when it is framed as a preference or fact. Poisoned entries are later retrieved as trusted context, enabling privilege escalation, data leakage, or sabotage that survives restarts and is hard to trace to its source.
Affected Systems
Agents with writable long-term memory or shared vector stores; protocols: RAG pipelines
Detection Signatures
- Memory entries containing imperative instructions rather than facts
- Writes to memory sourced from external content without provenance tags
- Behavioral shifts correlated with specific retrieved memory records
Remediation Steps
- 1
Validate before writing
Screen memory writes for instruction-like content and require provenance metadata.
- 2
Isolate sessions and tenants
Partition memory so one user or agent cannot poison another's context.
- 3
Snapshot and audit
Keep memory snapshots to enable diffing, forensics, and rollback after suspected contamination.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.