Persistent Memory Poisoning in AI Agents: From Risk to Repair

Overview

This series explains how untrusted content can cross sessions through persistent AI-agent memory, lose scope or authority, and later shape a task through direct, compositional, or trigger-based paths. It separates admission, persistence, recall, adoption, consequence, and repair, showing why controlled benchmark results support stage-specific safeguards—not universal deployment rates or a single safest backend.

Learning outcomes

Persistent memory becomes a delayed attack surface when old content crosses sessions without its scope, authority, or validity conditions.
Harm may be visible in one record, emerge from co-retrieved fragments, or activate only under a later context.
Write success and memory recall do not prove adoption, external consequence, or safe recovery.
The evidence supports stage-specific controls across admission, retrieval, action validation, and selective repair that preserves benign state.

Keywords

MemoryPoisoningAgentsPersistenceRetrievalProvenanceAuthorizationAdoptionRepairMemPoison

Chapters

Persistent Memory Poisoning in AI Agents: Delayed Attack Surface

How lost context turns past content into future guidance

8 min · How lost context turns past content into future guidance

8 min

Persistent Memory Poisoning in AI Agents: From Write to Action

Separate persistence, recall, adoption, and external consequence

8 min · Separate persistence, recall, adoption, and external consequence

8 min

Persistent Memory Poisoning in AI Agents: Direct, Compositional, and Triggered Harm

Why write-time filters miss future combinations and contexts

9 min · Why write-time filters miss future combinations and contexts

9 min

Persistent Memory Poisoning in AI Agents: Benchmark Evidence and Limits

Keep BCR, lifecycle checkpoints, and denominators distinct

12 min · Keep BCR, lifecycle checkpoints, and denominators distinct

12 min

Persistent Memory Poisoning in AI Agents: Controls and Selective Repair

Match safeguards to the stage where harmfulness appears

10 min · Match safeguards to the stage where harmfulness appears

10 min

Persistent Memory Poisoning in AI Agents: Safety Across Time

Preserve provenance, authority, scope, and useful state

10 min · Preserve provenance, authority, scope, and useful state

10 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-6 Premium

FAQ

Why is persistent AI-agent memory a delayed attack surface?

Persistent AI-agent memory is a delayed attack surface because untrusted content can cross a session boundary, lose its original scope or authority, and influence a later task.

How can memory poisoning become harmful without one malicious record?

Memory poisoning can become harmful when several plausible records are co-retrieved and composed, or when a conditionally valid record is activated by a later task.

What do MemPoison and MemSecBench actually measure?

MemPoison measures poisoned-target behavior under paired clean and poisoned tasks; MemSecBench traces write, persistence, recall, adoption, consequence, and repair. Their rates use different cases and denominators, so they should not be combined.

What should a safer AI-agent memory system verify?

A safer AI-agent memory system should preserve provenance, scope, time, and authority; evaluate the retrieved context and trigger; validate the concrete action; and verify selective repair that removes unsafe meaning while preserving benign memory.