Persistent Memory Poisoning

Attacker plants instructions or false facts in an agent's long-term memory so they replay in future sessions.

Impact

A one-time injection becomes a durable backdoor affecting every later conversation.

Why this severity

Impact High × Likelihood High = Critical

Impact high: one injection persists across sessions. Likelihood high: Microsoft documented widespread in-the-wild memory manipulation through crafted assistant links (2026).

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: AI Recommendation Poisoning via Crafted AI Assistant Links (MITRE ATLAS case study AML.CS0072, 2026)
Demonstration: Hacking ChatGPT's Memories with Prompt Injection (MITRE ATLAS case study AML.CS0040, 2024)

Exploits

Memory Writes Without Provenance Vulnerability · Critical severity

Leads to

Unauthenticated Agent Channels Vulnerability · Medium severity
Cascading Multi-Agent Failure Threat · High severity

Mitigated by

Memory Provenance & Review Guardrail · Fixes critical risks

Remediation

Tag every memory write with source, trust level, and author.
Require confirmation before storing instruction-like memories.
Let users inspect and delete stored memories.

How to verify

Inject a memory via a retrieved document and confirm it is quarantined.
Expired memories are absent from new sessions.

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM01:2025 Prompt Injection
LLM04:2025 Data and Model Poisoning

OWASP Top 10 for Agentic Applications 2026

ASI06:2026 Memory and Context Poisoning

MITRE ATLAS

AML.T0080.000 AI Agent Context Poisoning: Memory

NIST AI RMF 1.0

MEASURE 2.4 AI system functionality and behavior are monitored in production