Agents have multiple types of memory. In-context memory is the current conversation window — everything the agent can see right now. External memory is information stored outside the model: vector databases, knowledge bases, document stores, or conversation logs that the agent can retrieve from. Episodic memory is the record of past interactions the agent can look back on. Semantic memory is accumulated learned facts or preferences the agent applies across sessions.

Human memory naturally degrades and gets corrected. Agent memory doesn't — unless something explicitly overwrites or removes it. A belief written into an agent's external memory persists until it is deliberately cleared or expires.

"Poisoning" means writing false, manipulated, or attacker-controlled content into a memory store the agent trusts — so the agent later retrieves and acts on it as if it were legitimate fact.

Poisoning is distinct from lying to the agent in a conversation. In a conversation, the agent can apply skepticism and context. A poisoned memory entry is retrieved as prior context — as something the agent already "knows." The skepticism that might apply to a new claim often doesn't apply to retrieved memory.

Memory makes agents useful across sessions. Poisoning exploits exactly the property that makes memory valuable — its persistence and trusted status. The attack surface is proportional to how much the agent is designed to remember and trust.