Versatile AI Risk Assessment

AI threat catalogue Agentic and Autonomous AI Production

Agent Memory Poisoning (Persistent Context)

AI agents with persistent memory carry information from earlier sessions forward as trusted context for future decisions. If that memory is manipulated, the effect outlasts the original interaction.

As of: October 2026 · Catalogue version 2026.10.24.2 · 5 mitigations · 9 verified sources

Description

Many agent architectures maintain long-term memory, such as a vector store, a notes system, or logged session summaries, that persists across interactions and is drawn on as context for future tasks. If an attacker injects false content into that memory, through an ordinary request, a processed document, or a manipulated tool result, the agent adopts it as learned, trusted context. Unlike one-off RAG-specific attacks, the manipulation here carries forward beyond the original session into future, independent interactions, often with other users.

Possible impact

A poisoned memory silently and persistently skews the agent's decisions, often with no visible trigger in the current conversation, which makes detection and root-cause analysis considerably harder. Every future session that draws on the corrupted memory is affected, not just the original interaction. The EU AI Act requires effective human oversight and technical resilience against manipulation for high-risk systems.

Example

A support agent with persistent memory stores learned preferences from handled tickets. An attacker submits a ticket with a hidden instruction to approve refund requests over EUR 10,000 without review going forward. The agent records this as a working instruction. That poisoned preference then applies to all future tickets from any customer.

Recommended mitigations (5)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Provenance tracking per memory entry (document origin, timestamp, source)

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.

  • Segment memory storage by tenant and sensitivity level

    Technical
    Effect
    Preventive
    Implementation level
    Data, Infrastructure
    Classification and rationale

    Primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.

  • Write gates with content validation before every commit to persistent memory

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Decay or downgrade unverified memory entries over time

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Snapshots and rollback capability for agent memory

    Technical
    Effect
    Impact-limiting, Restorative
    Implementation level
    Data, Application, API & agents, Use & operations
    Classification and rationale

    Primarily technical: Versioned states or rollback mechanisms enable controlled recovery.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 ASI06:2026 · LLM01:2026 · LLM05:2026MITRE ATLAS AML.T0080.000EU AI Act Article 15(5) · Article 26(5) · Article 9(1), 9(2)(a), 9(2)(d)GDPR Article 32(1)(b) · Article 5(1)(d)

Verified references (9)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Achieve accuracy, robustness and cybersecurity Art. 15, Art. 42 Abs. 3 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028 · amended by Reg. 2026/1744

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    New: where a high-risk system falls within the scope of Regulation (EU) 2024/2847 on horizontal cybersecurity requirements and meets its conditions, it is deemed compliant with the cybersecurity requirements of Art. 15. Duplicate evidence is therefore not required.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Monitor operation and suspend on risk Art. 26 Abs. 5 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Deployer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Agentic and Autonomous AI.

Excessive Agency An AI system is granted more permissions or freedom to act than its task requires. Misalignment The AI system does not pursue the goals its operator or users intend but whatever it was actually optimized for. Agentic AI / Autonomous Agents AI agents plan multi-step tasks on their own and carry them out with tools such as email, databases, or code execution.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

For 9 further use cases, relevance depends on the system design, for example whether it remembers content beyond a single conversation. Show these use cases

Frequently asked questions

What is Agent Memory Poisoning (Persistent Context)?
AI agents with persistent memory carry information from earlier sessions forward as trusted context for future decisions. If that memory is manipulated, the effect outlasts the original interaction.
Which mitigations help against Agent Memory Poisoning (Persistent Context)?
The catalogue lists 5 mitigations, each with control type, effect and implementation level. First among them are Provenance tracking per memory entry (document origin, timestamp, source), Segment memory storage by tenant and sensitivity level and Write gates with content validation before every commit to persistent memory.
Which EU AI Act obligations does Agent Memory Poisoning (Persistent Context) touch?
The catalogue maps this threat to Art. 9, Art. 15 and Art. 26 Abs. 5 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system, Achieve accuracy, robustness and cybersecurity and Monitor operation and suspend on risk. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Agent Memory Poisoning (Persistent Context)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/agent-memory-poisoning/

← Back to the full catalogue