AI Agent Context Poisoning: Memory
How AML.T0080.000 AI Agent Context Poisoning: Memory shows up in practice: the mapped risk classes in this atlas, the documented incidents that prove it's real, and the scenarios and controls to learn and defend against it.
Mapped risks
Risk classes in this atlas that map to AML.T0080.000 — click through for the full definition, attack surface and controls.
Real-world cases
4Documented incidents, disclosed vulnerabilities and research that illustrate AML.T0080.000 — latest first, each with sources.
mem0's openmemory/api registered routers with no auth: an unauthenticated attacker could read/write/delete any user's stored memories (or globally pause memory for DoS), while a companion flaw exposed stored LLM API keys in plaintext and enabled SSRF to cloud metadata endpoints.
An academic paper reports MemGhost, a one-shot indirect-injection attack in which a single ordinary email causes a memory-enabled personal agent to silently write an attacker's false fact into long-term memory, conceal the write from its reply, and rely on the fiction in later sessions.
Microsoft AI Red Team whitepaper enumerating agentic failure modes, including resource/service exhaustion from runaway loops and fan-out.
Indirect injection could write attacker instructions into ChatGPT's long-term memory, persisting across chats to exfiltrate data until OpenAI mitigated it.
Practise it — interactive scenarios
Controls & guardrails that address this
4Guardrails across the risks mapped to AML.T0080.000, grouped by control function. Filter by control category below.
Being careful about what gets saved to long-term memory, labelling where it came from, and letting users see and delete their memories.
Watching for strange new memories — like instructions that suddenly appear — and holding them aside until checked.
Recording everything — questions, documents fetched, actions taken — so you can investigate when something goes wrong.
Live dashboards and alarms that notice unusual behaviour — spikes in errors, weird actions, sudden data access.