What is Memory and Context Poisoning?
Memory and context poisoning occurs when an adversary corrupts or seeds an agent’s stored context, such as conversation summaries, embeddings, or RAG stores, with malicious or misleading information. Agents depend on this stored context for continuity across tasks and reasoning cycles, so poisoned entries skew the agent’s reasoning, planning, and tool use to allow unsafe actions and data exfiltration.
Once written, poisoned context persists and carries across sessions. This persistence separates this risk from LLM01:2025 Prompt Injection, which involves one-time input prompts. Memory and context poisoning is also distinct from ASI01:2026 Agent Goal Hijack, which captures direct goal manipulation, though poisoned memory often leads to goal hijacking by changing how an agent interprets its goals.
Key Takeaways
- Memory and context poisoning (ASI06) is ranked #6 in the OWASP Top 10 for Agentic Applications 2026 and occurs when adversaries corrupt or seed an agent’s stored context with malicious data, biasing future reasoning, planning, or tool use across sessions
- Context includes summaries, embeddings, and RAG stores, and corrupted long-term memory frequently leads to goal hijack (ASI01) by altering goal interpretation and tool-selection logic
- Common patterns include RAG and embedding poisoning, shared user context poisoning, long-term memory drift, and trigger-based backdoors, as shown in attacks that corrupted Gemini’s long-term memory
- Prevention requires content validation on memory writes, memory segmentation between users, source provenance, and expiring unverified memory over time
Why it is Dangerous
An agent treats its stored context as trusted knowledge, so poisoned entries lead to:
- Unauthorized transactions, when a false fact stored as truth leads the agent to approve actions and skip the checks that would catch them
- Privilege escalation, when an agent loses track of earlier refusals and grants access it previously denied
- Blind spots in security tools, when poisoned memory teaches a detection agent to treat attack activity as routine
- Flawed business decisions that spread across agents, when a corrupted policy or fact in shared memory becomes the basis for other agents’ actions
- Data leakage across users and tenants, when weak separation in shared stores surfaces one party’s sensitive data in another’s results
Typical Manifestations
Poisoned data reaches agent memory through several paths:
- RAG and embedding poisoning, where manipulated data enters a vector database through a poisoned source, a direct upload, or an over-trusted pipeline
- Context-window manipulation, where crafted content injected into an ongoing conversation gets summarized or persisted into memory
- Long-term memory drift, where small doses of tainted data, summaries, or feedback from peer agents shift what the agent believes and prioritizes over time
- Trigger-based backdoors, where poisoned memory alters the agent’s persona and hides malicious instructions that activate on a specific trigger
- Shared context poisoning, where an attacker introduces data into a context shared by several through ordinary conversation, and later sessions act on it
Whatever the entry point, untrusted content becomes trusted memory.
Protecting Agent Memory
Mitigations span the full lifecycle of a memory entry, from write to expiration:
- Encrypt memory in transit and at rest, and restrict access with least privilege
- Accept writes only from authenticated, curated sources, require source attribution on every entry, and check new writes and model outputs for harmful or sensitive content before they are committed
- Keep an agent’s own outputs out of trusted memory to stop it from reinforcing its own errors, a.k.a., “bootstrap poisoning”
- Segment memory by user session and domain context, and give each tenant its own namespace in shared vector or memory stores
- Expire unverified memory to limit how long poisoning persists
- Weight retrieval by trust and tenancy, requiring two factors, such as a provenance score plus a human-verified tag, before high-impact memory surfaces, and decay low-trust entries over time
Agent memory must never be implicitly trusted.
