AI threat catalogueAgentic and Autonomous AIProduction
Agent Memory Poisoning (Persistent Context)
AI agents with persistent memory carry information from earlier sessions forward as trusted context for future decisions. If that memory is manipulated, the effect outlasts the original interaction.
Description
Many agent architectures maintain long-term memory, such as a vector store, a notes system, or logged session summaries, that persists across interactions and is drawn on as context for future tasks. If an attacker injects false content into that memory, through an ordinary request, a processed document, or a manipulated tool result, the agent adopts it as learned, trusted context. Unlike one-off RAG-specific attacks, the manipulation here carries forward beyond the original session into future, independent interactions, often with other users.
Possible impact
A poisoned memory silently and persistently skews the agent's decisions, often with no visible trigger in the current conversation, which makes detection and root-cause analysis considerably harder. Every future session that draws on the corrupted memory is affected, not just the original interaction. The EU AI Act requires effective human oversight and technical resilience against manipulation for high-risk systems.
Example
A support agent with persistent memory stores learned preferences from handled tickets. An attacker submits a ticket with a hidden instruction to approve refund requests over EUR 10,000 without review going forward. The agent records this as a working instruction. That poisoned preference then applies to all future tickets from any customer.
Recommended mitigations (5)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Provenance tracking per memory entry (document origin, timestamp, source)Technical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Provenance tracking per memory entry (document origin, timestamp, source)” is primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.
Segment memory storage by tenant and sensitivity levelTechnical
- Effect
- Preventive
- Implementation level
- Data, Infrastructure
- Reason for the classification
- “Segment memory storage by tenant and sensitivity level” is primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.
Write gates with content validation before every commit to persistent memoryTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Write gates with content validation before every commit to persistent memory” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.
Decay or downgrade unverified memory entries over timeTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Decay or downgrade unverified memory entries over time” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.
Snapshots and rollback capability for agent memoryTechnical
- Effect
- Impact-limiting, Restorative
- Implementation level
- Data, Application, API & agents, Use & operations
- Reason for the classification
- “Snapshots and rollback capability for agent memory” is primarily technical: Versioned states or rollback mechanisms enable controlled recovery.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (7)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 ASI06:2026 Memory & Context PoisoningASI06 Memory & Context Poisoning, pp. 24–26 of the official PDF OWASP FoundationOriginal
- MITRE ATLAS AML.T0080.000 MemoryATLAS.yaml technique object with id AML.T0080.000 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 15(5) Accuracy, robustness and cybersecurityArticle 15(5), including the express references to data/model poisoning, adversarial examples/evasion, confidentiality attacks and model flaws European Union (EUR-Lex)Original
- EU AI Act Article 26(5) Obligations of deployers of high-risk AI systemsArticle 26(5) European Union (EUR-Lex)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- GDPR Article 32(1)(b) Security of processingArticle 32(1)(b), read with Article 32(1) and 32(2) European Union (EUR-Lex)Original
- GDPR Article 5(1)(d) Principles relating to processing of personal data — accuracyArticle 5(1)(d) European Union (EUR-Lex)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- RAG (retrieval augmented generation) The model pulls matching documents from your own knowledge base before answering.
Related threats
More entries from the topic group Agentic and Autonomous AI.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Agent Memory Poisoning (Persistent Context)”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/agent-memory-poisoning/