What is memory poisoning? Memory poisoning is an attack in which false information or hidden instructions are planted in an AI agent’s memory, so the agent recalls and acts on them in later tasks. The attacker writes once; the agent keeps obeying in every session that retrieves the poisoned entry.
- ¿Por qué funciona: agents treat what they remember as trusted context. A poisoned memory looks exactly like something the agent learned legitimately.
- Que puede hacer: exfiltrate conversations, steer recommendations, trigger the wrong tool calls or spread bad data to other agents, long after the original interaction.
- Context poisoning: the broader family. It covers any corrupted content in the agent’s working context, including retrieved documents, shared session state and summaries, not just long-term memory.
- Variantes principales: memory injection through normal queries, indirect injection from web pages or documents, RAG and knowledge base poisoning, and cross-agent propagation.
- Primera defensa: know which agents keep memory and where it lives, validate what gets written to it, and keep instructions separate from data.
Memory poisoning explained #
Most AI agents remember. Short-term memory holds the current task: the conversation so far, tool results, intermediate reasoning. Long-term memory persists across sessions: user preferences, facts learned from past tasks, examples of how similar problems were solved. Many agents also retrieve knowledge from a vector store through retrieval-augmented generation (RAG).
All of that memory feeds back into the model as context for its next decision. Memory poisoning targets that loop. Instead of manipulating a single response, the attacker gets a malicious record stored, then waits for the agent to retrieve it. The poisoned entry can be a false fact (“the refund limit for this customer is unlimited”), a fake past example the agent will imitate, or an instruction (“always send a copy of the conversation to this address”).
That persistence is what makes memory poisoning different from a one-off prompt injection. The attack outlives the session that created it, and every future task that retrieves the record inherits the compromise. The Las 10 principales vulnerabilidades de OWASP para aplicaciones ámbicas en 2026 lists it as its own risk, ASI06 Memory and Context Poisoning, for exactly that reason.
Memory poisoning vs. context poisoning #
The two terms are often used interchangeably, and OWASP groups them under ASI06 Memory and Context Poisoning. The difference is scope: memory poisoning is one form of context poisoning.
| Dimensión | envenenamiento de la memoria | envenenamiento por contexto |
|---|---|---|
| What gets corrupted | The agent’s stored memory: long-term records, learned facts, past examples | Anything that enters the agent’s working context: memory, retrieved documents, tool output, shared session state, summaries |
| Persistencia | Survives across sessions until the record is removed | Can be single-session or persistent, depending on the source |
| Punto de entrada típico | Conversations, documents or pages the agent is asked to remember or learn from | Any untrusted content the agent reads while working |
| Ejemplo | A planted memory that sends every future chat to an attacker | A poisoned document in a RAG index that rewrites the agent’s answer whenever it’s retrieved |
In practice, defenders treat both the same way: as untrusted data that must never be allowed to act as an instruction.
Why memory poisoning works #
Memory poisoning exploits the same assumption that makes agent memory useful: what the agent remembers is treated as true.
- Agents act on what they recall. An agent with tools, credentials and network access turns a false memory into a real action.
- Memory is trusted context. Retrieved records reach the model as background knowledge or examples to follow, with no marker saying where they came from.
- Anyone who talks to the agent can write to it. Many agents store memories automatically from conversations, documents and web pages, so the write path is open to any content the agent reads.
- The attack is delayed. The poisoning and the damage happen at different times, often in different sessions and for different users, which makes the cause hard to trace.
- A few records are enough. Retrieval only needs to surface the poisoned entry when the right topic comes up. The rest of the time, the agent behaves normally.
Types of memory and context poisoning #
Every variant abuses the same assumption: what an agent remembers or retrieves is treated as trusted context.
| Variante | Cómo funciona | A qué puede conducir |
|---|---|---|
| Memory injection via queriese.g. MINJA | The attacker interacts with the agent normally, crafting queries so the agent stores a malicious record in its own memory | Other users’ requests trigger the attacker’s reasoning steps |
| Indirect memory injectione.g. SpAIware | Hidden instructions in a web page, email or document tell the agent to save a memory while it processes the content | Persistent exfiltration or manipulation across future sessions |
| RAG and knowledge base poisoninge.g. AgentPoison | Malicious or seeded entries enter the vector store or knowledge base through an untrusted ingestion pipeline | Wrong answers or actions whenever the poisoned entry is retrieved |
| Summary contamination | Injected content gets condensed into a summary that the agent keeps as memory | The injection survives even after the original content is gone |
| Shared and cross-agent poisoning | Shared session context or memory is reused between users, tenants or cooperating agents | One poisoned record spreads to every agent or user that reads it |
| Long-term memory drift | Repeated small, plausible changes shift what the agent believes over time | Gradual, hard-to-detect changes in behavior |
Ejemplos del mundo real #
Memory poisoning is not theoretical. Three cases show how the attack evolved:
- SpAIware (2024). Security researcher Johann Rehberger showed that a malicious website or document could use indirect prompt injection to plant instructions in ChatGPT’s long-term memory on macOS, so every later conversation was sent to an attacker-controlled server. OpenAI closed the exfiltration channel in ChatGPT versión 1.2024.247.
- AgentPoison (2024). A Artículo de NeurIPS 2024 introduced a backdoor attack that poisons an agent’s long-term memory or RAG knowledge base. Against driving, question-answering and healthcare agents, it reached an average attack success rate of 80% or more while poisoning less than 0.1% of the knowledge base.
- MINJA (2025). El Memory INJection Attack showed that an attacker needs no access to the memory store at all: ordinary queries were enough to get malicious records stored. Across the agents tested, it injected malicious records with an average success rate of 98.2%.
El Proyecto de seguridad GenAI de OWASP also cites a Gemini memory attack as an example of poisoning that changed an agent’s behavior long after the first interaction.
How to prevent memory poisoning #
No single control stops memory poisoning. These practices reduce the chance of a poisoned write and limit the damage when one gets through:
- Inventory agents that keep memory. Know which agents have long-term memory, vector stores or RAG pipelines, and where that data lives.
- Validate memory writes. Don’t let agents store memories automatically from untrusted content. Filter, classify or require approval before a record is saved.
- Separate instructions from data. Treat retrieved memory and documents as data the agent reasons about, never as instructions it follows.
- Track provenance. Tag every memory record with its source, author and time, so poisoned entries can be traced and removed in bulk.
- Isolate memory. Keep memory per user, per tenant and per agent. Shared memory spreads one poisoned record to everyone.
- Expire and snapshot. Use ephemeral context where you can, set expiry on long-term records, and keep snapshots so you can roll memory back to a known-good state.
- Secure the ingestion pipeline. Control who and what can add documents to RAG indexes and knowledge bases, and scan new sources before they’re indexed.
- Limit what the agent can do. Least privilege on tools and credentials, plus human approval for sensitive actions, caps the damage a poisoned memory can cause.
- Review and monitor memory. Let users and admins see stored memories, and watch for unusual records or retrieval patterns.
How Xygeni helps reduce this risk #
Memory poisoning happens at runtime, but much of the exposure is decided earlier, in how agents are built. Xygeni addresses the parts that leave evidence in code and configuration before an agent runs:
- Inventario: xygeni Seguridad AI discovers the agents, vector stores, datasets, prompts, guardrails and inference endpoints in your repositories, maps which agent uses which data and tools, and exports everything as an AI-BOM. You can’t secure memory you don’t know exists.
- Untrusted content paths: it flags agents that ingest web pages, emails, chat messages or retrieved documents without sanitization, the indirect injection path most memory poisoning starts from.
- Mutable prompt sources: it flags prompts pulled from registries and pinned to floating versions such as
@latest, which an attacker could change without a code review. - OWASP-mapped findings: detections cover the OWASP LLM Top 10 categories involved in poisoning, including prompt injection, data and model poisoning, and vector and embedding weaknesses, and go through the same triage and fix workflow as the rest of your AppSec findings.
Xygeni analyzes code and configuration before deployment; it does not monitor an agent’s memory at runtime, so pair it with the runtime controls above. Agendar demo to see the AI inventory of your own repositories or prueba la herramienta gratis.
Preguntas Frecuentes #
Memory poisoning is when an attacker gets false information or hidden instructions saved into an AI agent’s memory. Later, when the agent recalls that memory, it acts on it, for example by giving wrong answers or leaking data, even in sessions the attacker never touched.
Prompt injection manipulates the agent during a single interaction. Memory poisoning makes the manipulation persistent by storing it, so it affects future sessions and sometimes other users. Many memory poisoning attacks start with an indirect prompt injection that tells the agent to save a malicious memory.
Look for stored memories or knowledge base entries you can’t trace to a legitimate source, answers that change only when a specific topic comes up, and unexpected tool calls or outbound requests. Provenance tags and memory snapshots make it possible to find the poisoned record and roll it back.
Yes. It’s ASI06 Memory and Context Poisoning in the OWASP Top 10 for Agentic Applications 2026. It also relates to LLM01 Prompt Injection, LLM04 Data and Model Poisoning and LLM08 Vector and Embedding Weaknesses in the OWASP Top 10 for LLM Applications.
