AG06:2026 — Memory & Context Poisoning

Slide 7 · Boundaries

AG06 is specifically about corrupting what an agent stores and retrieves. Three things it is not about.

Not about manipulating the agent in the current conversation turn

If an attacker sends a message right now and the agent responds to it incorrectly in the same conversation — that's live prompt injection or input manipulation. AG06 requires that the attacker's influence was written into a memory store that the agent retrieves from. The key test: does the harm persist after the conversation ends? If not, it's a different risk category.

Not about corrupting the agent's training or model weights

Training data poisoning (corrupting the underlying model by manipulating what it was trained on) is a separate research area and a separate risk. AG06 is about runtime memory — the external stores and retrieved context the deployed agent uses during operation. The model itself is not modified in AG06 attacks.

Not about stealing data that was put into memory legitimately

If an attacker queries an agent and extracts information that other users legitimately stored — that's a data leakage or access control failure. AG06 is about writing false information in, not reading legitimate information out. (In practice these can co-occur, but the defining characteristic of AG06 is the write-side corruption, not the read-side extraction.)

AG06 is:

Attacker-controlled content was written into a memory store the agent trusts — whether via an ingestion pipeline, a direct write, or by instructing the agent to write it — and the agent later retrieved and acted on that content as if it were legitimate, accurate, and trustworthy.

← Back Why this is new →