The Persistence Problem
Standard prompt injection is inherently bounded. An attacker injects a payload into a document the agent reads; the agent executes the injected instruction; the session ends and the damage is contained to that interaction. Security teams have built their threat models around this assumption: injection is a per-session risk.
Memory poisoning breaks that assumption entirely. When an AI agent maintains long-term memory — a vector store, a database of past interactions, a persistent context window — an attacker who successfully poisons that memory does not need access to future sessions. The memory carries the payload forward automatically. The agent "learns" the attacker's instruction and recalls it whenever the topic arises, regardless of whether the original attack vector is still active.
The OWASP Agentic AI Top 10 lists this as ASI06: Memory and Context Poisoning. The definition is deliberately broad — "any manipulation of the data an agent uses to construct its understanding of past interactions" — because the attack surface is equally broad. Vector stores, conversation logs, user preference databases, fine-tuning datasets: all are memory. All can be poisoned.
How MINJA Works
Research by Dong et al. (2025) formalized the Memory Injection Attack (MINJA) and measured it against production-grade agent systems. The attack proceeds in three phases, each exploiting a different assumption in how agents manage context.
Injection via Normal Query
The attacker sends a normal-looking message that contains a hidden payload — a false belief about a vendor, a security policy, or a trust relationship. The agent processes it and stores the interaction in memory.
Memory Consolidation
The agent's memory system consolidates the poisoned interaction into its long-term store. The false belief is now indexed alongside legitimate memories. There is no flag, no anomaly score, no audit trail distinguishing it from truth.
Trigger on Future Query
Days or weeks later, a legitimate user asks a question that retrieves the poisoned memory. The agent responds based on the false belief — recommending a malicious vendor, bypassing a security check, or leaking data — with full confidence.
The measured results: 95% injection success rate across tested systems (the payload reliably enters long-term memory), and 70% attack success rate (the poisoned memory is retrieved and acted upon when the target query arrives). These are not theoretical numbers — they were measured against agents with real vector-store backends.
Why This Is Worse Than It Looks
The asymmetry is severe. The attacker needs a single successful injection. The defender must audit every memory entry — potentially millions — on an ongoing basis, with no reliable signal distinguishing poisoned entries from legitimate ones. The cognitive load is inverted.
Cross-user contamination makes it worse. In multi-user agent deployments where memory is shared — a team assistant, a customer service agent serving multiple accounts — a single poisoned entry can affect every user whose query retrieves it. The Lakera AI research (November 2025) demonstrated this in a simulated enterprise scenario: one poisoned interaction with the support agent changed how the agent responded to a security question for every subsequent user in that shared context.
Detection is also fundamentally harder than with prompt injection. Prompt injection produces anomalous outputs in the same session as the injection — there is at least a temporal connection between attack and effect. Memory poisoning separates these events by arbitrary time. By the time the harmful output appears, the injection event may be weeks old and far outside any active monitoring window.
Defensive Architecture
There is no single fix. Memory poisoning is a category of attack, not a specific technique, and defenses need to address the architecture, not just the payload.
Memory provenance tagging. Every entry in long-term memory should carry metadata: source (user input, tool output, internal reasoning), timestamp, session ID, and a trust tier. Entries from external sources — documents, web pages, tool responses — should carry lower default trust than entries from verified internal sources.
Retrieval-time verification. Before acting on retrieved memory, the agent should check whether the retrieved fact is consistent with authoritative sources. Claims about policies, vendor relationships, or access permissions should be verified against canonical systems of record, not taken from memory alone.
Memory expiration and decay. Long-term memory should not be permanent by default. Implementing TTLs on stored facts — particularly facts sourced from user input — limits the window during which a poisoned entry can cause harm. Periodic re-validation of high-stakes memories against authoritative sources forces stale or incorrect entries out of the store.
Isolation for multi-user deployments. Shared memory between users is the highest-risk configuration. Where shared context is architecturally necessary, it should be scoped to read-only facts from verified sources, with user-generated content isolated in per-user stores that cannot contaminate shared retrieval.
The Threat Model Shift
The security industry spent 2024–2025 building defenses against prompt injection. Input filtering, output guardrails, sandboxed execution — all of these assume the attack and the effect are temporally adjacent. Memory poisoning invalidates that assumption.
The attacker's goal is no longer to hijack the current session. It is to corrupt the agent's future. That is a fundamentally different threat model, and it requires a fundamentally different defensive posture: one that treats agent memory with the same adversarial skepticism we apply to any external data source, and one that audits agent behavior over time rather than only at the point of input.
ASI06 is not a footnote in the OWASP Agentic AI Top 10. It is the threat that scales with agentic deployment — the more memory agents accumulate, the larger the attack surface, the longer the potential dormancy window, and the higher the cost of a successful injection. Building memory security into agent architecture from the start is not optional.