The most common attack path is indirect: the attacker doesn't need direct access to the memory system. They need access to something the agent ingests and stores. This includes: documents that the agent indexes into a RAG system (uploaded files, web pages the agent crawls, emails the agent processes), content that the agent's ingestion pipeline automatically imports, or API responses from external sources that the agent stores as learned facts.

The attacker controls the content. The agent's ingestion pipeline writes it to memory. The attacker never touches the memory store directly.

Users with legitimate write access to the knowledge base, document store, or vector database can directly insert poisoned entries. This includes: administrators of the RAG pipeline who can inject documents, employees who can upload files the agent indexes, or anyone with API-level access to the memory backend. Insider attacks via memory are particularly dangerous because the poisoned entries look exactly like legitimate entries — they were written through the same channels.

A multi-step attack: an attacker first injects a prompt into the agent's current conversation (via live injection), instructing the agent to write something specific to its persistent memory. The agent, following the injected instruction, performs the memory write — and the poisoned belief persists after the conversation ends. The attacker used the agent as the write mechanism, bypassing whatever input validation was applied to the memory store directly.