Memory Poisoning: When an AI Agent Learns the Wrong Thing for the Long Term
Secure agent memory with provenance, write gates, tenant isolation, trust scoring, expiry, review, rollback, and poisoning tests.
Memory poisoning occurs when false, malicious, or manipulated data enters an AI agent’s session context, user profile, knowledge store, or long-term memory. Unlike an injection limited to one run, poisoned data can return across later sessions and influence decisions, tool selection, and other users.
The core defense is to treat every memory write as a risky state change with provenance, schema, policy, tenant boundaries, expiry, and rollback. An agent must not convert conversation content or retrieved documents into durable truth simply because the model finds them useful.
Attack surface
Memory is not one uniform data store
Each memory class needs separate write rights, trust, and lifecycle.
Session context lasts one run but can redirect the current plan. Episodic memory records events. Profile memory stores user preferences or attributes. Semantic memory contains reusable knowledge. Procedural memory and skills are more dangerous because they can change how the agent acts.
Poison may arrive through users, email, tickets, RAG documents, tool output, other agents, or malicious skills. “Remember that this customer is verified” cannot replace KYC state in the authoritative system.
The OWASP Top 10 for Agentic Applications 2026 identifies Memory and Context Poisoning as ASI06, where false or malicious content persists and shapes future behavior. See the OWASP Agentic Top 10.
