Memory poisoning
Corrupting what an AI agent keeps and reuses across sessions, such as saved memories, conversation summaries, embeddings or retrieval stores, so that an attacker’s instruction or false fact steers later reasoning or tool use (OWASP ASI06:2026 Memory & Context Poisoning; MITRE ATLAS AML.T0080). Gate memory writes in code, scope them per user and record their source.
- Also called
- context poisoning · agent memory poisoning
- Identifiers
- ASI06:2026 Memory & Context Poisoning
Covered in
Defend agent memory and context against poisoning (OWASP ASI06)
OWASP ASI06 Memory & Context Poisoning: how an instruction or false fact saved once in agent memory, conversation summaries or a retrieval store steers later sessions, users and agents, and the write, scope, provenance, expiry and recovery controls that contain it.
Worked threat model: an LLM agent with tools
A complete worked threat model for an LLM agent with tools: the data-flow diagram, the threats from prompt injection, excessive agency, data exfiltration, confused-deputy and memory poisoning, and the mitigations, mapped to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications 2026.
Bound agent spending, memory and recovery
Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
Keep retrieval inside the user’s data boundary
Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.
Red-team LLM applications and agents by their effects
A red-teaming method for LLM features and agents: scope the whole system, map attacks to OWASP and MITRE ATLAS identifiers, score trials from observed effects, report rates with confidence intervals and retest on every model or provider change.
Contain LLM misinformation (OWASP LLM07:2026)
Stop plausible but wrong model output from driving decisions and actions: ground answers in sources, verify every citation, separate generation from execution with a claim-check-act pattern, gate consequential actions on a human, and evaluate factuality on your own domain.
Practice: RAG access control lab: Stop a retriever from returning another tenant’s documents · Local project: Enforce retrieval and tool boundaries across crashes · Local project: Gate model and provider changes on a versioned red-team corpus