"Memory and Context Poisoning occurs when an attacker manipulates the data stored in an agent's memory systems — including conversational context, RAG knowledge bases, session state, and long-term storage — causing the agent to operate based on false, misleading, or attacker-controlled information across one or more interactions."
The attack targets stored data — not just what's being said right now. This distinguishes AG06 from live prompt injection (which manipulates the current conversation turn). Memory poisoning targets information that will persist and be retrieved later. The attack surface includes: vector database entries, RAG document stores, session logs, user preference stores, agent scratchpads, and any other external storage the agent reads from.
The goal is not to disrupt the agent's current response — it's to shape future responses by corrupting the information the agent treats as trusted background knowledge. The agent retrieves the poisoned entry as if it were legitimate prior context, learned fact, or established preference. It doesn't know the information was planted — it just knows it "remembers" it.
The persistence dimension is what distinguishes this risk. A poisoned memory entry may affect every future interaction that retrieves it — potentially hundreds or thousands of conversations — from a single write event that occurred once in the past. The attack multiplies across time.