Memory Poisoning
highMemoryDefinition
An attacker gets the AI to save a false 'fact' or hidden instruction into its long-term memory. From then on it re-reads that planted note in every future chat — a one-time trick that keeps working.
This is recommended as a granular sub-risk of #38 Prompt injection (Cyber & Data Security · Technology Risk). Distinguished from a single-session #38 bypass and from training-data #36 poisoning by its persistence in the agent's runtime memory store. Your 44-row Enterprise Risk Mapping is unchanged — this is a suggestion for inclusion.
Where it attaches
The system components this risk arises at.
Detection signals
- ▸ Memory entries containing instruction-like content
- ▸ Persistent behaviour change spanning sessions
- ▸ Memory written shortly after the agent read untrusted content
Controls & guardrails that address this
4Grouped by control function, with the AI lifecycle stage(s) to apply each and the other risks it addresses. Filter by control category below.
Being careful about what gets saved to long-term memory, labelling where it came from, and letting users see and delete their memories.
Watching for strange new memories — like instructions that suddenly appear — and holding them aside until checked.
Recording everything — questions, documents fetched, actions taken — so you can investigate when something goes wrong.
Live dashboards and alarms that notice unusual behaviour — spikes in errors, weird actions, sudden data access.
Framework mappings
Real-world cases
8Actual published events that illustrate this risk — click through for the writeup and sources.
Indirect injection could write attacker instructions into ChatGPT's long-term memory, persisting across chats to exfiltrate data until OpenAI mitigated it.
Microsoft AI Red Team whitepaper enumerating agentic failure modes, including resource/service exhaustion from runaway loops and fan-out.
An academic paper reports MemGhost, a one-shot indirect-injection attack in which a single ordinary email causes a memory-enabled personal agent to silently write an attacker's false fact into long-term memory, conceal the write from its reply, and rely on the fiction in later sessions.
mem0's openmemory/api registered routers with no auth: an unauthenticated attacker could read/write/delete any user's stored memories (or globally pause memory for DoS), while a companion flaw exposed stored LLM API keys in plaintext and enabled SSRF to cloud metadata endpoints.
Anthropic and EPFL researchers reportedly showed self-propagating goals can spread between LLM agents through the editable system-prompt and state files that agent harnesses use to persist context, with some payloads surviving 20 transmission rounds in simulated multi-agent collaborations.
Microsoft Security reportedly catalogued an in-the-wild technique across dozens of companies where websites embed hidden prompt-injection payloads behind Ask-AI deep-links that, clicked in an authenticated assistant session, silently write a permanently-trust-this-vendor tag into the assistant's long-term memory.
Varonis Threat Labs reportedly chained flaws in consumer Microsoft Copilot Personal so a crafted link with a hidden autorun parameter fired prompt execution on a single click, exfiltrated data from connected OAuth apps, and planted persistent memory rules that survived password resets and device re-enrollment; reportedly patched Aug 2026 with no evidence of abuse.
A paper reportedly presenting the first Write-Execute-Forget lifecycle benchmark for agent memory poisoning across many harness, memory-backend and model configurations, reporting that malicious memories persist in most cases and the full write-to-execute chain succeeds about half the time, with repair effectiveness varying widely by backend.
Practise this in an interactive scenario
An 'Ask AI' button quietly plants a permanent 'trusted source' rule in your assistant's memory
A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later
A planted 'standing goal' copies itself agent-to-agent through the team's shared config files
A single poisoned document plants a standing instruction that survives every reset