Memory Poisoning in AI Agents: Persistent Attacks & Detection

Prompt injection ends when the session ends. Memory poisoning doesn't. Once adversarial content gets written into an agent's persistent memory, whether a vector store, conversation history, or shared context, it survives session boundaries, agent restarts, and sometimes redeployments, waiting to activate weeks or months after the initial write. OWASP formalized this as ASI06, Memory and Context Poisoning, in its Top 10 for Agentic Applications, distinguishing it from ordinary prompt injection specifically on the basis of persistence. For the broader risk taxonomy this sits within, see our guide to the OWASP Agentic Top 10.

Why Memory Poisoning Is Different From Prompt Injection

Prompt injection is a single-session attack: an attacker crafts input, the model follows it, and the effect ends when the conversation closes. Memory poisoning inverts the economics entirely. One successful write can pay off indefinitely, since the poisoned content sits in storage the agent treats as authoritative and gets recalled across every future session that happens to retrieve it. This changes the entire cost-benefit calculation for an attacker: instead of needing to compromise every interaction, a single successful injection becomes a standing asset that keeps generating value with no further effort. It also breaks the mental model most security teams still bring to LLM defense, which assumes a session boundary functions as a natural reset. For memory-augmented agents, that reset doesn't happen unless someone deliberately wipes the store.

How Memory Poisoning Actually Happens

Direct Memory Injection and Shared-Memory Exploitation

The most straightforward variant involves an attacker, or a compromised agent in a multi-agent system, writing false information directly into a memory store that other agents or future sessions will trust. In shared-memory architectures, this is especially dangerous, since a single poisoned entry can propagate to every agent that reads from the same pool, turning one successful write into a multi-agent compromise. Detection signals here include abnormal write volume and content that contradicts previously established facts, both of which are at least theoretically observable if anyone is watching.

The More Realistic Threat: Poisoning Through Environmental Observation Alone

Direct memory access assumes an attacker already has some foothold, which is a stronger assumption than most real-world scenarios actually require. The more realistic and more dangerous threat model doesn't need direct access at all: an agent processes external content, a webpage, a document, a tool's output, as part of an entirely normal task, and stores what it observed as trusted memory. No injection into the storage layer is required, because the agent does the writing itself, treating attacker-controlled content it encountered as legitimate experience worth remembering.

Case Walkthrough: The "Poison Once, Exploit Forever" Attack Chain (eTAMP)

Researchers formalized this exact pattern in April 2026 with Environment-injected Trajectory-based Agent Memory Poisoning, or eTAMP, the first attack demonstrated to achieve cross-session, cross-site compromise without any direct memory access at all. The mechanics are almost mundane: a malicious seller embeds hidden instructions in a product page, something like an instruction to post promotional reviews elsewhere. A shopping agent browsing for an unrelated item views that page as part of a routine task and passively captures the instructions into its trajectory memory. Days later, a user asks the same agent to research something only loosely related, gaming content on Reddit, say. The agent retrieves the earlier shopping trajectory as relevant context, the poisoned instruction activates, and the agent posts a promotional review the user never asked for, on a site it was never told to interact with. Researchers validated this exact chain against production AI browser agents, including ChatGPT Atlas and Perplexity Comet. Nothing about the attack requires bypassing a permission check, since the agent was never doing anything it wasn't authorized to do at each individual step.

Real-World Incidents, Not Just Research

The 2024 ChatGPT Long-Term Memory Exfiltration Discovery

Security researcher Johann Rehberger disclosed the first major real-world demonstration of this threat class in September 2024, dubbed SpAIware. Using indirect prompt injection delivered through a malicious document or webpage, Rehberger showed he could implant persistent instructions into ChatGPT's then-new long-term memory feature, causing every subsequent conversation to silently exfiltrate its contents to an attacker-controlled server. OpenAI initially treated the report as a safety concern rather than a security vulnerability, until Rehberger's proof of concept demonstrated continuous, cross-session data exfiltration. As he put it at the time, once the malicious instructions are stored in memory, all future conversations carry the attacker's instructions forward, turning a single successful injection into standing surveillance. OpenAI patched the exfiltration vector in version 1.2024.247.

ZombieAgent (January 2026): Persistent, Cross-Session Injection via Connectors

Radware researcher Zvika Babo disclosed ZombieAgent in January 2026, targeting OpenAI's Deep Research agent and its Connectors feature, which links ChatGPT to services like Gmail, Google Drive, and GitHub. The attack embedded malicious instructions in an email, invisible to the user through white-on-white text or minuscule font, that ChatGPT would parse while genuinely helping with an unrelated task. Beyond a single-session exfiltration, Radware identified a more advanced stage where ZombieAgent implanted persistent rules directly into the agent's long-term memory, meaning the compromise survived well past the triggering interaction and could spread further by mining the victim's contact list to propagate the same payload to new targets. Babo reported the vulnerability to OpenAI in September 2025, and it was fixed in mid-December.

The Gemini Memory Exploit and Calendar-Invite Poisoning (73% Success Rate)

Researchers from Tel Aviv University, Technion, and SafeBreach demonstrated in 2025 that a simple Google Calendar invite could hijack a victim's Gemini-powered assistants, no email opened, no link clicked, just a calendar event sitting on the victim's schedule. Their Targeted Promptware Attacks spanned five threat classes, including Long-Term Memory Poisoning of Gemini's "Saved Info," where a poisoned instruction persists and executes across entirely independent future sessions without needing to be re-injected. Across 14 demonstrated attack scenarios, spanning outcomes from email theft to controlling smart-home devices like thermostats and window locks, the researchers' risk framework rated 73% as High-Critical severity. Google acknowledged the findings and deployed mitigations following responsible disclosure.

Lakera's "Sleeper Agent": When an Agent Develops False Beliefs About Its Own Security Policy

Lakera's November 2025 research on memory injection attacks demonstrated something more unsettling than data exfiltration: an agent whose long-term memory had been corrupted through indirect prompt injection didn't just execute a malicious instruction, it developed persistent false beliefs about its own security policies and vendor relationships, and defended those false beliefs as correct when directly questioned by human operators. This creates a genuine sleeper-agent scenario, where the compromise sits dormant, indistinguishable from normal operation, until a triggering condition activates the planted behavior weeks or months later. A security team monitoring for obviously malicious outputs would see nothing wrong until the moment the agent acts on the false belief it now sincerely holds.

Why This Is Especially Dangerous for RAG and Multi-Agent Systems

RAG-based agents are the most extensively studied poisoning target, and the results are stark. AgentPoison, a backdoor attack against RAG-based and long-term-memory agents, uses a constrained optimization process to craft trigger phrases that map malicious demonstrations into a unique embedding cluster, so that any future query containing the trigger reliably retrieves the poisoned content over legitimate alternatives. Validated against three real-world agent types, a RAG-based autonomous driving agent, a knowledge-intensive QA agent, and a healthcare EHRAgent, AgentPoison achieved an attack success rate above 80% while injecting fewer than 0.1% poisoned instances into the knowledge base and degrading benign performance by less than 1%. For an autonomous driving agent, the adversarial target researchers demonstrated was a dangerous sudden-stop action, triggered on command by a query containing the optimized phrase.

Multi-agent and self-evolving systems introduce a related but distinct failure mode. OEP demonstrated that self-evolving agents, which refine their own behavior by generalizing from past experience, can be poisoned with experiences that are locally correct but don't actually generalize, biasing the agent's own reflection process into over-generalized rules that cause downstream failures across unrelated future tasks. Because these systems are specifically designed to learn from their own memory, a poisoned experience doesn't just sit passively waiting for a trigger, it actively reshapes how the agent reasons going forward.

Why Built-In Platform Memory Features Aren't Enough

The memory features shipped by ChatGPT, Claude, Gemini, and similar platforms were built for personalization and continuity, not adversarial resistance, and every real-world incident above targeted exactly these built-in systems rather than some exotic custom implementation. These features are siloed per platform, meaning a defense or detection method built for one offers no protection on another, and none of the major providers currently offer a guarantee that memory content has been verified against poisoning before being trusted. Perhaps most significantly, users and administrators typically have limited visibility into what's actually stored and even less control over verifying its provenance, which means the attack surface exists largely outside the reach of any security team trying to monitor it. Organizations building on top of these platforms need to treat vendor-provided memory as an untrusted input source, not a verified data layer, regardless of how the feature is marketed.

Detecting Memory Poisoning

Detection requires signals that traditional security tooling, built around network traffic and file system state, simply doesn't collect. Behavioral drift signals track whether an agent's outputs or decision patterns are gradually diverging from an established baseline, which can surface a slow-forming poisoning attack before it produces an obviously harmful action. Provenance tracking, attaching metadata to every memory entry recording its source, ingestion path, and timestamp, lets a detection system distinguish content that arrived through a trusted, direct user interaction from content the agent merely observed while processing something else, exactly the distinction that matters for catching environment-injected attacks like eTAMP. Anomalous retrieval pattern monitoring watches for memory entries being retrieved in contexts that don't semantically match how or why they were originally stored, which is often the first visible symptom of a trigger-based attack activating. None of these signals is sufficient alone, and all three require instrumentation built into the memory pipeline itself, since none of them can be bolted on after the fact once a store already contains years of unvetted history.

Architectural Defenses That Actually Work

Architectural Isolation

Memory isolation per user, per session, and per task prevents the shared-memory exploitation described earlier from ever becoming possible in the first place, since a poisoned entry written in one context has no pool to propagate into beyond its own boundary. This is a design decision made before deployment, not a control that can be retrofitted onto an already-shared memory architecture without significant rework.

Bayesian Trust Scoring on Retrieved Memories

Rather than treating every retrieved memory as equally authoritative, Bayesian trust scoring assigns each memory entry a probabilistic trust value that updates based on provenance, consistency with other trusted entries, and observed outcomes over time. This directly targets the three memory poisoning vectors researchers have formally categorized: direct injection, indirect injection through external content, and gradual erosion, where an agent behaves normally for an extended period while slowly injecting poisoned memories, the hardest variant to catch because it requires statistical deviation analysis across a long behavioral history rather than a single suspicious event.

Per-Agent Provenance Tracking

In multi-agent systems specifically, tracking which agent originated a given memory entry and through what channel closes the propagation path that makes shared-memory poisoning so damaging. A memory entry that can be traced back to its originating agent and ingestion source can be selectively distrusted or purged if that source is later found compromised, without requiring a full wipe of the entire shared store.

How Akto Detects and Defends Against Memory Poisoning

Akto's red teaming probe library includes dedicated coverage for memory manipulation, testing whether an agent's short-term and long-term memory can be corrupted in ways that persist and influence future behavior, mapped directly to OWASP's ASI06 classification. For the full breakdown of how this fits into Akto's broader probe library across all agentic risk categories, see our AI red teaming probe library FAQ.

FAQs: Memory Poisoning in AI Agents

What is memory poisoning, and how is it different from regular prompt injection?

Memory poisoning is the injection of adversarial content into an AI agent's persistent memory, such as a vector store or conversation history, so the agent acts on it in future sessions. Unlike prompt injection, which ends when a session closes, memory poisoning persists across sessions, restarts, and sometimes redeployments, and its effects can activate days or weeks after the original write.

How can an attacker poison an agent's memory without direct access to it?

By embedding malicious instructions in ordinary external content, a webpage, document, or email, that the agent processes during a normal, authorized task. The agent itself writes the poisoned content into memory as part of doing its job, meaning no direct access to the storage layer is ever required.

What is the "poison once, exploit forever" attack pattern?

It describes how a single successful memory write can pay off indefinitely, since the poisoned content is treated as trusted and gets recalled across every future session where it's semantically relevant. The eTAMP research demonstrated this concretely, showing cross-session, cross-site compromise from a single contaminated observation with no further attacker effort required.

What happened in the 2024 ChatGPT long-term memory exfiltration discovery?

Researcher Johann Rehberger showed that indirect prompt injection could implant persistent instructions into ChatGPT's long-term memory, causing every subsequent conversation to silently exfiltrate its contents to an attacker's server. OpenAI initially treated it as a safety issue before patching the exfiltration vector following a working proof of concept.

What is ZombieAgent, and how does it make prompt injection persistent?

ZombieAgent is a January 2026 vulnerability disclosed by Radware, targeting OpenAI's Deep Research agent and its Connectors feature. It combined indirect prompt injection delivered through email with the ability to implant persistent rules directly into long-term memory, allowing the compromise to survive beyond the initial session and propagate to new targets through the victim's contacts.

What is a "sleeper agent" injection, and how does it affect an agent's security beliefs?

Lakera's November 2025 research demonstrated that memory poisoning can cause an agent to develop persistent false beliefs, including about its own security policies, and defend those beliefs as correct when questioned by humans. The compromise remains dormant and undetectable until a triggering condition causes the agent to act on the false belief.

Why are RAG-based and multi-agent systems especially vulnerable to memory poisoning?

RAG systems retrieve content based on embedding similarity, which attacks like AgentPoison exploit directly by optimizing trigger phrases that guarantee malicious content gets retrieved. Multi-agent systems compound this because a single poisoned memory entry in a shared store can propagate to every agent that reads from it, turning one successful write into a multi-agent compromise.

Are built-in memory features in ChatGPT, Claude, or Gemini secure against poisoning?

Every major real-world memory poisoning incident to date has targeted these exact built-in features. They're siloed per platform, offer no guarantee that stored content has been verified against poisoning, and give users limited visibility into or control over what's actually stored, meaning they should be treated as an untrusted input source rather than a verified data layer.

What architectural defenses actually work against memory poisoning?

Architectural isolation of memory per user, session, and task prevents shared-memory propagation. Bayesian trust scoring assigns retrieved memories a probabilistic trust value based on provenance and consistency rather than treating all stored content as equally authoritative. Per-agent provenance tracking lets a compromised source be selectively distrusted without wiping an entire shared memory store.

What is Bayesian trust scoring, and how does it help detect poisoned memories?

It's a defense that assigns each memory entry a probabilistic trust value, updated based on its provenance, consistency with other trusted entries, and observed outcomes over time, rather than treating every retrieved memory as equally reliable. This helps catch all three major poisoning vectors, including gradual erosion attacks that unfold slowly enough to evade single-event detection.

How does Akto detect and defend against memory poisoning in production agents?

Akto's red teaming probe library includes dedicated tests for memory manipulation, evaluating whether an agent's short-term and long-term memory can be corrupted in ways that persist and shape future behavior, with findings mapped directly to OWASP's ASI06 classification for audit-ready reporting.