A normal prompt injection is like a trap that fires once. Memory poisoning is a trap an agent carries with it and can trigger weeks later, against a completely different person than the one who planted it.
AI memory poisoning is a persistent attack on an agent's memory, where an attacker writes malicious content into the agent's long-term memory so it acts on that content in future sessions. Unlike a prompt injection, which disappears when the chat window closes, poisoned memory persists across every subsequent interaction and can steer decisions for a completely different user weeks later — the attack and its effect are temporally decoupled, which massively complicates attribution and incident response.
OWASP recognized this distinction in 2026 by adding "Memory and Context Poisoning" as ASI06 to its Agentic AI Top 10 — a signal that it stopped being an academic curiosity and became a formally recognized risk category any agent security program should explicitly cover.
Recent research shows attack success rates of 80%, 95%, and even 99.8% against LLM-based agent implementations, depending on conditions. The MINJA (Memory Injection Attack), presented at NeurIPS 2025, achieves over 95% injection success rate and 70% attack success rate under idealized conditions — and demonstrated that an attacker can poison an agent's memory with nothing more than seemingly normal queries, with no privileged access of any kind required.
In December 2025, researchers published MemoryGraft, an attack that compromises AI agents by planting malicious entries into their long-term memory through content that looks completely benign — the attack doesn't rely on obviously suspicious text, but on content designed to pass any superficial review while fulfilling its malicious function once the agent retrieves it from memory in a future context.
Since malicious content can look completely normal at the moment it's written to memory, defense can't rely solely on content filtering at the entry point — it requires periodically auditing what's actually stored in an agent's long-term memory, limiting which sources can write to that memory without review, and treating any persistent-memory capability as an attack surface that needs its own threat model, separate from the one you already apply to traditional prompt injection.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel