The agent's active conversation window: everything currently in the prompt. This is what most people think of when they think of "the conversation." It disappears at the end of the session. Poisoning this tier affects only the current interaction — but it's the easiest tier to write to, because anything in the conversation goes into context. This is the foundation for live prompt injection, which can serve as a stepping stone to write into persistent tiers.

Documents, facts, and entries stored in an external database that the agent queries using semantic similarity. When the agent is asked a question, it retrieves the most relevant stored entries and includes them in its context. This is the highest-impact poisoning target — because a single malicious entry, once written, can be retrieved into every future conversation where it matches semantically.

A record of past conversations the agent can look back on. Used by agents that need continuity — "last time you asked me about X, you said Y." Poisoning this tier plants false precedents: the agent "remembers" things that never happened or decisions that were never made.

Persistent facts the agent has accumulated about a user, organization, or domain — stored explicitly for future use. "User prefers metric units." "This account has admin privileges." Poisoning this tier is the most targeted attack: it places false persistent facts directly into the agent's model of the world.