Early AI systems were stateless: every conversation started fresh. An attacker could influence a single conversation, but the influence ended when the session closed. The attack surface was bounded by one interaction at a time. There was no accumulated state for an adversary to corrupt and benefit from later.

Agents with persistent memory accumulate state across sessions. They retrieve from growing knowledge bases. They remember past interactions. They apply learned preferences. This is what makes them genuinely useful for complex, ongoing work — but it also means a single write event can corrupt an arbitrarily large number of future interactions.

The attack multiplier: In a stateless system, a successful attack affects 1 conversation. In an agent with persistent memory and many users, a successful memory write can silently affect every subsequent conversation that retrieves the poisoned entry — until the entry is discovered and removed.

Because the attacker acts once (the write) and the effect unfolds later (the retrieval), the attack is difficult to detect in real time. The conversations that retrieve the poisoned entry look normal — the agent is behaving consistently with what it "knows." There's no live injection to detect, no unusual tool call, no anomalous input. The harm is in the invisible background context shaping every answer.