The attacker gains the ability to write content that will enter the agent's memory — through an ingestion pipeline, a direct memory API, a shared document store, a conversation the agent summarizes, or by instructing the agent to store something. Write access doesn't require privileged access to the memory backend; indirect channels are sufficient.

The attacker's content enters the memory store — as a document chunk, a fact, a preference, a session summary, or a shared knowledge entry. It looks exactly like legitimate content because it was written through the same channel used by legitimate content. No technical anomaly is generated at write time.

The write is complete. The attacker has no further role. They are no longer present in any subsequent conversation. Their influence is now encoded in the memory store — passive, persistent, and invisible. There is no ongoing attack to detect. The poisoned entry waits.

A legitimate user or process triggers a query that semantically matches the poisoned entry. The memory system retrieves it with high confidence. The agent incorporates it as trusted context. The attacker's desired outcome unfolds — across one conversation or a thousand — without anyone present who knows what happened.