Memory Writes Without Provenance

Agents persist memories from any context source with no record of where the content came from.

Impact

Untrusted retrieved content is promoted to trusted long-term state.

Why this severity

Impact High × Likelihood High = Critical

Impact high: untrusted content becomes trusted state. Likelihood high: the in-the-wild memory manipulation campaign relied on assistants storing memories from untrusted links.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: AI Recommendation Poisoning via Crafted AI Assistant Links (MITRE ATLAS case study AML.CS0072, 2026)
Demonstration: Hacking ChatGPT's Memories with Prompt Injection (MITRE ATLAS case study AML.CS0040, 2024)

Exploited by

Persistent Memory Poisoning Threat · Critical severity
MCP Tool Description Poisoning Threat · Critical severity

Mitigated by

Memory Provenance & Review Guardrail · Fixes critical risks

Remediation

Store provenance metadata alongside each memory entry.
Weight or exclude low-trust memories at recall time.
Apply TTLs and periodic integrity review.

How to verify

Memory store schema rejects entries missing a source field.
Recall excludes entries flagged as untrusted.

Pattern

memory.write({ text, source: ctx.origin, trust: ctx.trust, ttl: '30d' });

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM04:2025 Data and Model Poisoning

OWASP Top 10 for Agentic Applications 2026

ASI06:2026 Memory and Context Poisoning

MITRE ATLAS

AML.T0080.000 AI Agent Context Poisoning: Memory

NIST AI RMF 1.0

MEASURE 2.4 AI system functionality and behavior are monitored in production