Memory Poisoning

This is a defensive research paper, not an active exploit or vulnerability disclosure. It formally describes how persistent AI agents can be poisoned when untrusted inputs (including prompt injections or unverified model inferences) get stored and later recalled as if they were verified agent history or user commitments, and proposes a typed provenance/guardrail system to prevent this. The core contribution is a mitigation architecture, evaluated against a small hand-authored conformance suite, not a report of a real-world attack.

Updated Sep 3, 2026

Researchers at Oasis Security found that a malicious webpage can reach an unauthenticated local Ollama instance running behind NVIDIA NemoClaw and use it to implant hidden instructions into the AI model itself. This effectively lets a remote attacker who only controls a webpage a victim visits achieve persistent, unauthenticated tampering with a locally hosted AI agent's behavior.

Updated Aug 26, 2026

This is an academic research paper (not an active exploit) demonstrating that persistent agent memory systems are highly vulnerable to simple, plainly worded false statements: poisoning just 1.2% of a memory corpus dropped answer accuracy from 0.85 to 0.30. The authors show that both write-time content screening and provenance-weighted retrieval defenses fail to catch these low-effort attacks, exposing a fundamental architectural gap rather than a specific software bug.

Updated Aug 24, 2026

mcp-memory-service, a semantic memory backend used by AI agents, exposes all /api/documents/* routes without any authentication check even when an API key or OAuth is configured. This lets an unauthenticated remote attacker read, write, or delete an agent's persistent memory store, enabling memory poisoning and data theft. The flaw is fixed in version 10.67.1.

Updated Aug 16, 2026 · CVSS 9.8

This is a defensive research paper (not an active exploit) describing RAG-IDS, a multi-agent intrusion detection framework that mitigates knowledge-base poisoning and prompt-injection attacks against RAG-based network flow classifiers. The paper reports strong empirical recovery of classification performance under simulated attacks, indicating a proactive defense contribution rather than a newly disclosed vulnerability or active threat. Severity is low because this describes mitigation research, not a real-world exploit or vulnerable deployed system.

Updated Aug 11, 2026

A vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.10.1) allows an attacker to reuse another user's FAISS vector namespace, exposing owner-only embedded content and enabling persistent poisoning of future query results. This creates cross-user data leakage and an ongoing integrity risk in shared or multi-tenant Langflow deployments where vector stores back retrieval-augmented generation (RAG) agents.

Updated Jul 29, 2026 · CVSS 7.1

Academic research demonstrates that malicious instructions planted inside persistent memory files (used by agentic coding assistants like Claude Code and OpenAI Codex for cross-session context) can influence and hijack future agent sessions. This is a controlled research study, not an observed in-the-wild exploit, but it highlights a real and underexplored attack surface as agents adopt long-term memory.

Updated Jul 17, 2026

This item is an OWASP Gen AI Security Project blog post discussing memory and context poisoning as a conceptual risk category (ASI06) for agentic AI systems, not a report of a specific active exploit or vulnerability. It explains why persistent agent memory can become an attack surface if untrusted input is carried forward and later trusted, but contains no technical exploit details, affected products, or indicators of compromise. Severity is set to low because this is educational/awareness content rather than a disclosed incident or vulnerability.

Updated Jul 5, 2026

A researcher demonstrated that an image generated by ChatGPT could act as a carrier for an indirect prompt injection that hijacked Claude Opus 4.7's memory tool, causing it to persist false memories into future conversations. This shows that even hardened, reasoning-heavy models remain vulnerable to multimodal adversarial inputs crafted using puzzle-like framing to bypass safety reasoning.

Updated Jul 5, 2026

This is a defensive research paper, not an active threat or exploit disclosure. It presents a detection method that identifies memory-poisoning attacks in LLM agents by analyzing tool-call ordering patterns (specifically, a memory-recall call preceding an email-send call), achieving very high classification accuracy. Since it describes a detection technique rather than a vulnerability or attack, severity is low from a threat standpoint, though the underlying attack class it detects (memory poisoning leading to data exfiltration) remains a legitimate concern.

Updated Jul 5, 2026

Attackers seed false facts or standing instructions into an agent's long-term memory or RAG store, quietly steering decisions across future sessions long after the original malicious input is gone.

Updated Jul 3, 2026