Memory poisoning: the one injection that never leaves

Short summary

Persistent memory in AI agents creates a new attack surface where prompt injections survive across sessions and re-enter context on every retrieval. Security researcher Johann Rehberger demonstrated SPAIware writing malicious instructions into ChatGPT's long-term memory, and the MemoryGraft paper shows poisoned experience records causing durable behavioral drift in autonomous agents like MetaGPT. Three key defenses apply: scope memory per instance, validate writes for injection patterns, and maintain per-entry provenance to enable surgical removal of poisoned entries.

• •Memory poisoning turns one-shot prompt injections into persistent, cross-session attacks via agent memory or RAG stores
• •SPAIware (Rehberger, 2024) and MemoryGraft (arXiv:2512.16962) demonstrate real-world and academic exploitation of this vector
• •Defensive controls: scope memory per instance, validate writes against injection signatures, and keep per-entry provenance for incident response

Generated with AI, which can make mistakes.