What is agent memory poisoning?

Agent memory poisoning is an attack that gets false facts or attacker instructions saved into an AI agent’s persistent memory, so they keep steering the agent in later sessions after the original input is gone. The OWASP GenAI Security Project lists it as ASI06, Memory & Context Poisoning, in its Top 10 for Agentic Applications 2026, published December 2025.

Indirect prompt injection is often how the poison gets in. Injection acts on the session the text arrives in; poisoning is that text getting saved and outliving it.

An agent can save the poison itself: PMPA, from a September 2026 paper by Shuhuai Huang, Jingfeng Zhang, and Hong Jia (arXiv:2609.13889), hid instructions in ordinary external content and reports an average injection success rate of 66.9% and a cross-session attack success rate of 81.7% against Anthropic’s Claude Code. Or someone who gets write access to the memory store plants it: Zenity Labs’ AgentCorruption research used an Amazon Bedrock AgentCore agent’s over-broad execution role to plant memories telling other agents to fetch an attacker’s page before every answer. Zenity’s October 8, 2026 post says AWS has patched the issues, though AWS calls the behavior documented and expected.

Nothing stored has to be false, either. MemForm (arXiv:2610.14431, October 2026), a benchmark from Haowen Pan and co-authors, found that changing which genuine experiences an agent keeps, or the order it consolidates them in, could push its later behavior off course in its tests across six models, and the defenses it evaluated only partly helped.