Poisoned memory persists: an instruction or false fact saved once can steer later sessions, other users or other agents long after the original attack.
- Record where each stored memory came from, and treat memory as untrusted data, never as a permission grant.
- Isolate memory per user and tenant, and validate what is written to it.
- Make memory entries easy to inspect, expire and quarantine.
Guides on this site
Defend agent memory and context against poisoning (OWASP ASI06)
OWASP ASI06 Memory & Context Poisoning: how an instruction or false fact saved once in agent memory, conversation summaries or a retrieval store steers later sessions, users and agents, and the write, scope, provenance, expiry and recovery controls that contain it.
Bound agent spending, memory and recovery
Enforce budgets and stop conditions outside the model, and make retained context and side effects recoverable.
Keep retrieval inside the user’s data boundary
Carry document permissions through ingestion, retrieval, caching and citations so a model never receives another tenant’s records.
Practice
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.