Memory Poisoning

Attackers exploit an agent's reliance on short- or long-term memory to inject malicious or false data, corrupting future decisions, bypassing security checks, or escalating privilege via memory recall. In a multi-agent system: A shared-memory travel-booking agent has a false 'chartered flights are free' pricing rule repeatedly reinforced by an attacker, unti…

Use this profile to understand the building block briefly, place it in the model, and switch to the 360° assessment when needed.

Content type

Concept

Theoretical construct: explains a term, principle, or mental model.

Classification level

Structure

What organizes, connects, or makes decisions possible.

Available perspectives

Open this building block directly in an already curated view.

360°

In brief

Memory Poisoning in brief

Memory poisoning deliberately inserts false or harmful information into an AI system's long-term context so later answers or actions are manipulated.

Where does it come from?

The term applies classic data and model poisoning to agentic systems with persistent memory. OWASP presents memory poisoning as a risk for LLM applications and explains how manipulated memories can later act as trusted context.

The mental model

Imagine a forged note in an assistant's notebook that it treats as true on every later assignment. One stored sentence can steer many decisions after its original source has disappeared.

Key building blocks

Persistence

Manipulated information survives beyond a single request.

Retrieval

Later tasks load poisoned information as seemingly relevant context.

Provenance

Stored content needs a source, trust level, and change history.

When is it useful?

Memory poisoning turns memory into a security boundary and calls for validation, cleanup, and traceable provenance of stored content.

OWASP GenAI – LLM04: Data and Model Poisoning OWASP GenAI Security Project

Why is this building block relevant?

Attackers exploit an agent's reliance on short- or long-term memory to inject malicious or false data, corrupting future decisions, bypassing security checks, or escalating privilege via memory recall.