Memory & Context Poisoning in Agentic AI Systems (OWASP ASI06 Conceptual Overview)
First seen Jul 5, 2026 · Updated Jul 5, 2026
This item is an OWASP Gen AI Security Project blog post discussing memory and context poisoning as a conceptual risk category (ASI06) for agentic AI systems, not a report of a specific active exploit or vulnerability. It explains why persistent agent memory can become an attack surface if untrusted input is carried forward and later trusted, but contains no technical exploit details, affected products, or indicators of compromise. Severity is set to low because this is educational/awareness content rather than a disclosed incident or vulnerability.
Technical Analysis
The post discusses the general mechanism of memory poisoning: an agent ingests untrusted input (from users, tool outputs, or retrieved documents) and persists it into long-term or session memory, where it is later retrieved and treated as trusted context in future reasoning or planning steps. The entry point is any interface that writes to agent memory (chat history, RAG stores, scratchpads, vector DBs), and the attacker's gain would be influence over future agent decisions without needing to re-inject on every turn. This crosses trust boundaries because content that was once untrusted input becomes indistinguishable from legitimate system/agent-authored context once stored. No specific framework, protocol, exploit chain, or proof-of-concept is provided in the source material — it is a high-level thought-leadership piece defining the risk category rather than reporting a new finding.
Detection Signatures
- No specific IOCs provided in source.
- General defensive heuristics for memory poisoning: monitor for anomalous or repeated insertion of instruction-like text into memory/vector stores; watch for sudden shifts in agent behavior correlated with recent memory writes; flag memory entries containing imperative phrasing (e.g., 'always', 'ignore previous', 'from now on') originating from tool output or retrieved documents rather than the system prompt.
Remediation Steps
- 1
Segregate trust levels in memory
Tag memory entries with provenance (user, tool, system, retrieved-document) and apply different trust/validation levels when reasoning over them.
- 2
Sanitize before persistence
Filter or normalize content before writing it to long-term memory or vector stores, stripping instruction-like patterns from untrusted sources.
- 3
Periodic memory review/expiry
Implement TTLs, review workflows, or anomaly detection for persistent memory stores to catch poisoned entries before they influence many future sessions.
- 4
Least-privilege memory writes
Restrict which agents/tools can write to shared or long-term memory, and require validation or human approval for high-impact memory updates.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.