Memory Poisoning: The Attack That Lingers Weeks After the Conversation That Started It

By Carlos Montiel | Enterprise AI Specialist
Leer en español →
Published: 2026-07-28 | By: Carlos Montiel | Reading time: ~4 minutes

A normal prompt injection is like a trap that fires once. Memory poisoning is a trap an agent carries with it and can trigger weeks later, against a completely different person than the one who planted it.

What sets it apart from normal prompt injection

AI memory poisoning is a persistent attack on an agent's memory, where an attacker writes malicious content into the agent's long-term memory so it acts on that content in future sessions. Unlike a prompt injection, which disappears when the chat window closes, poisoned memory persists across every subsequent interaction and can steer decisions for a completely different user weeks later — the attack and its effect are temporally decoupled, which massively complicates attribution and incident response.

Official recognition: ASI06 in OWASP's Agentic AI Top 10

OWASP recognized this distinction in 2026 by adding "Memory and Context Poisoning" as ASI06 to its Agentic AI Top 10 — a signal that it stopped being an academic curiosity and became a formally recognized risk category any agent security program should explicitly cover.

Alarmingly high attack success rates

Recent research shows attack success rates of 80%, 95%, and even 99.8% against LLM-based agent implementations, depending on conditions. The MINJA (Memory Injection Attack), presented at NeurIPS 2025, achieves over 95% injection success rate and 70% attack success rate under idealized conditions — and demonstrated that an attacker can poison an agent's memory with nothing more than seemingly normal queries, with no privileged access of any kind required.

MemoryGraft: benign-looking content, malicious in effect

In December 2025, researchers published MemoryGraft, an attack that compromises AI agents by planting malicious entries into their long-term memory through content that looks completely benign — the attack doesn't rely on obviously suspicious text, but on content designed to pass any superficial review while fulfilling its malicious function once the agent retrieves it from memory in a future context.

How to defend against an attack that doesn't look like one

Since malicious content can look completely normal at the moment it's written to memory, defense can't rely solely on content filtering at the entry point — it requires periodically auditing what's actually stored in an agent's long-term memory, limiting which sources can write to that memory without review, and treating any persistent-memory capability as an attack surface that needs its own threat model, separate from the one you already apply to traditional prompt injection.

Carlos Montiel
Enterprise AI Solutions Architect
Specialist in LLMs, Agents, and Orchestration
guatemalia.com/en/#contact · info@guatemalia.com

Need to implement AI at your company?

Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.

Contact Carlos Montiel

info@guatemalia.com