Memory Poisoning Turns AI Agent Memory Into a Delayed Attack Surface

Persistent memory makes an AI agent more useful: it can retain preferences, past work, procedures, and context between tasks. It also creates a distinct security problem. If untrusted content is stored as memory, an attacker may not need to cause an immediate failure. They can wait for the agent to retrieve the poisoned entry in a later, seemingly unrelated task. 15

How a delayed memory-poisoning attack works

Memory poisoning is an integrity attack on what an agent later treats as its own accumulated knowledge. The basic sequence is:

1. Injection: The agent encounters adversarial or misleading content through an ordinary input or environment it is allowed to read.
2. Persistence: That content is written into long-term memory, potentially alongside legitimate notes, facts, or prior task records.
3. Dormancy: The agent continues performing benign work, so the original write may attract little attention.
4. Retrieval: A future query, task, phrase, or semantically similar context causes the system to retrieve the poisoned entry.
5. Activation: The retrieved content influences the agent’s reasoning, recommendation, or use of a tool. 125

The key distinction from an ordinary prompt injection is time. A successful malicious memory write can influence later sessions, even if the initial interaction does not visibly alter the agent’s behavior. 130

This does not require an attacker to directly edit a memory database in every scenario. Research on web agents, for example, describes a cross-session, cross-site attack in which a manipulated page is observed during normal operation, contaminates memory, and is activated in a later task. 2

What the University of Calgary trajectory analysis examined

Researchers associated with the University of Calgary reported analyzing 2,614 simulated multi-step attack trajectories involving memory-enabled LLM agents. Rather than treating attack success as a single yes-or-no event, the work examined how compromise developed over time. It considered four attack patterns: chain poisoning, policy rewriting, backdoor triggering, and slow drift. 14

Chain poisoning

Chain poisoning plants a harmful premise early in a multi-step process. Later reasoning can then build on that premise through otherwise plausible intermediate decisions, eventually producing an unsafe outcome. The security-relevant point is that no individual step necessarily looks obviously malicious when viewed in isolation. 14

Policy rewriting

Policy rewriting corrupts remembered rules, approvals, priorities, or operating assumptions. When a later task retrieves those altered records, the agent can follow the attacker’s substituted policy rather than the intended one. 14

Backdoor triggering

A backdoor-style memory entry remains dormant until a later task contains the right trigger—such as a particular phrase, task context, or semantic match. Prior work has demonstrated the broader risk of a single contaminated observation being stored and activated in future work across sessions and websites. 214

Slow drift

Slow drift describes smaller changes that shift an agent’s recommendations or patterns of action over time. Research on persistent memory compromise finds that later tasks with lexical or semantic similarity can surface poisoned records and induce unsafe patterns across sessions. 29

Why one-time agent testing can miss the attack

The Calgary analysis emphasizes a temporal problem: some attacks may be difficult to distinguish from normal behavior at the time of injection. The harmful effect is separated from the initial memory write and may emerge only after later retrieval. 14

That means risk is not necessarily linear. It can remain quiet through several interactions, then rise when a relevant task, context, or trigger causes the poisoned memory to rank highly enough for retrieval. Other research similarly frames memory poisoning as a two-phase process—first injection, then later activation through retrieval. 5

A test that asks only, “Did the agent fail on this prompt?” can therefore produce false reassurance. Likewise, a step-by-step evaluation that resets context, skips intervening sessions, or never exercises a relevant future task may not reproduce the conditions needed for activation.

The more appropriate unit of testing is the full trajectory:

• the untrusted input and memory-write decision;
• intervening benign sessions;
• future queries and semantic variants that may retrieve the entry;
• the agent’s reasoning after retrieval; and
• any resulting action through tools or external systems. 214

Why persistent memory raises the stakes for autonomous agents

The immediate effect of poisoning may be a bad answer. The larger concern arises when an agent has authority to take actions after consulting its memory. A later retrieval can influence an email, browser-based workflow, database operation, or another tool-mediated task. The eTAMP research specifically shows that permission-based defenses alone may not stop a threat introduced indirectly through an environment the agent is permitted to inspect. 2

This makes memory part of the operational security boundary, not merely a convenience feature. A memory system that accepts untrusted material and later presents it as useful context can turn an earlier low-visibility event into a delayed incident. 14

A practical testing and defense checklist

The cited research does not establish a universal defense or show how broadly organizations have adopted mature incident-response practices. It does, however, support treating persistent memory as a security-sensitive system that needs explicit controls.

Test across time, not just prompts

Use adversarial evaluations that include delayed triggers, repeated sessions, intervening benign tasks, varied retrieval wording, and realistic tool permissions. Test whether the agent can recover after a suspicious memory write is identified. 214

Track provenance of memory writes

Record where memory came from, why it was stored, and what trust conditions applied at write time. Research on long-term-memory protection proposes tamper-evident logging of writes and authorization decisions, illustrating the value of auditable memory histories. 31

Separate memory from authority

A retrieved note should not automatically carry the authority of a verified instruction or policy. Limit what an agent can do with low-trust or externally derived memories, and keep credentials and high-impact actions compartmentalized.

Inspect both writes and retrievals

Detection cannot focus only on incoming prompts. Teams need visibility into what enters memory, what is recalled later, and which downstream actions follow. One proposed detection approach uses observable retrieval-to-action transitions, though its reported results are architecture-dependent and should not be treated as a universal solution. 18

Plan for revocation and rollback

A response process should be able to locate suspicious entries, quarantine or remove them, invalidate derived summaries where feasible, and review the actions taken after potentially poisoned memories were retrieved.

The central lesson

Memory poisoning changes the question from “Can an agent resist a malicious prompt right now?” to “Can it safely manage information that may influence it much later?” The Calgary work’s analysis of 2,614 trajectories underscores why the answer cannot be determined from a single interaction. For memory-enabled agents, security testing must follow the entire path from untrusted input, to storage, to delayed retrieval, to real-world action. 14