Advanced · Safety

Memory Poisoning

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. An attack that plants false or malicious entries in an agent's persistent memory so they are trusted and acted on in later sessions.

Technical Definition

An attack that plants false or malicious entries in an agent's persistent memory so they are trusted and acted on in later sessions.

How it works

Agents with long-term memory introduced a new attack surface in 2026: anything the agent remembers becomes part of its future decision context. Memory poisoning exploits this by getting a malicious instruction or false fact written into memory — via a poisoned web page, a crafted email, or a compromised tool result — where it persists long after the original session and inherits the trust of 'things I learned earlier.' Defenses include provenance tagging on every memory write, quarantine and review of externally sourced memories, periodic memory audits, and least-privilege scoping so a poisoned preference cannot authorize payments.

Related Concepts

• Memory-Native Agents — Agents architected around persistent, structured memory — episodic, semantic, and procedural — rather than treating memory as a bolt-on retrieval index.
• Agent Memory — Information an agent retains beyond the current context window — episodic history, learned facts, preferences, and task state.
• Prompt Injection — An attack where untrusted input (a webpage, email, tool output) contains instructions that hijack an LLM's behavior in an agentic context.