AI agent memory poisoning

What it is

Many AI agents keep information between steps or sessions: conversation history, retrieval indexes, stored notes. Memory and context poisoning means planting misleading or malicious content in those stores so that later decisions are skewed. OWASP's agentic list names it "Memory and Context Poisoning" (ASI06).

Why it differs from a single prompt injection

A prompt injection acts within one interaction. Poisoned memory can persist, so something stored earlier may influence later sessions. MITRE ATLAS tracks this as AI Agent Context Poisoning (AML.T0080), with memory and thread variants.

Research worth reading

• AgentPoison (Chen et al., 2024) studies poisoning of an agent's long-term memory or knowledge base. arXiv:2407.12784
• MINJA studies injecting memory records through ordinary queries to the agent. arXiv:2503.03704
• OWASP LLM Top 10 (2025) covers data and model poisoning (LLM04) and vector and embedding weaknesses (LLM08). genai.owasp.org

Results in these papers come from the authors' own experimental setups; we do not restate their numbers as general facts.

Four questions to ask about any agent memory

1. Where did each entry come from, and can it be traced?
2. Does the entry read like data, or like an instruction?
3. Does it contradict something previously trusted?
4. What could the agent do if it acted on it?

Our working idea is to score entries on these axes, then quarantine and recover. See the approach. This is a concept / research preview; no detection method here is validated or complete.