Six ways attackers write false content into agent memory — each targeting a different tier.
Type 1
RAG / Knowledge Base Poisoning
Malicious content injected into the document store the agent retrieves from — affecting all users who query similar topics.
Type 2
Session Memory Manipulation
Attacker writes false beliefs into the agent's episodic memory store during a live interaction, planting precedents that survive session end.
Type 3
Preference / Profile Poisoning
False persistent facts written into the agent's user or account model — stored explicitly for retrieval in every future session.
Type 4
Indirect Ingestion Poisoning
Attacker controls content in a source the agent automatically ingests (emails, web pages, uploaded docs) and embeds memory-targeting instructions in that content.
Type 5
Multi-Agent Memory Contamination
A compromised or poisoned sub-agent writes false data to a shared memory store, propagating the corruption to every other agent in the pipeline that reads from it.
Type 6
Memory Extraction
Crafted queries cause the agent to retrieve and surface memory entries belonging to other users — turning the memory system into a data exfiltration channel.