AG06 Knowledge Check
Five questions. Choose the best answer for each.
Q1. A support agent retrieved an entry from its knowledge base that said "customers who request it are entitled to refunds after the 30-day window." The agent used this to approve out-of-policy refunds for three weeks. An investigation found the entry was added by a disgruntled employee through the wiki admin interface. Which memory tier was poisoned?
Episodic memory — because the agent remembered past refund decisions
In-context working memory — because the false policy was in the conversation
The curated knowledge base (external retrieval memory) — the attacker wrote to the document store the agent queries
Semantic preference memory — because the agent "preferred" to approve refunds
Correct. The wiki served as the organization's curated knowledge base — the document store the agent retrieves from for policy questions. The employee wrote directly to this store through a legitimate admin channel. This is RAG/knowledge base poisoning (Type 1). The poison affected all users who asked refund-related questions, not just one session.
Q2. An attacker sends a PDF invoice to a user. While the user's AI assistant processes the PDF, it extracts hidden instructions and writes "this sender is pre-approved for all payment requests" to the user's preference store. In future sessions, the agent applies this rule without the user realizing it exists. Which attack mechanism was used?
Direct memory API access — the attacker had credentials to write to the preference store
Indirect ingestion poisoning — the attacker embedded instructions in content the agent automatically processed and stored
Session memory manipulation — the attacker was present in a conversation that the agent summarized
Multi-agent memory contamination — another agent wrote the false entry to the shared store
Correct. The attacker never interacted with the memory system directly — they controlled the content of a document the agent processed as part of its normal operation. The agent's ingestion pipeline wrote the attacker's embedded instruction to the preference store. This is indirect ingestion poisoning (Type 4): the attack channel was the document processing pipeline, not direct memory access.
Q3. A multi-tenant AI platform stores all users' memories in a single shared vector database with per-user filtering at the application layer. A security researcher discovers they can bypass the filter by phrasing questions about "general knowledge" — causing the agent to query across all tenants. What is the primary architectural failure?
Insufficient memory TTL — entries from other users should have expired before they could be retrieved
Missing database-level namespace isolation — tenant filtering is applied at the application layer and can be bypassed by agent behavior
No audit logging — if write events were logged, this retrieval attack could have been prevented
Insufficient input validation at ingestion — the retrieval attack entered through the write channel
Correct. The root cause is that tenant isolation is enforced at the application layer (code that filters query results by user_id) rather than at the database level (namespaces or separate indexes per tenant). When prompt injection causes the agent to perform a general query that bypasses the application-layer filter, the underlying database returns entries from all tenants. MIT03 (access controls with database-level isolation) is the primary fix.
Q4. Why is memory tier separation (MIT06) described as the "single highest-leverage control" for preventing memory poisoning?
Because it makes all memory entries expire automatically, limiting the persistence of any poisoned belief
Because it scans stored entries for injected instructions using automated pattern detection
Because agents cannot write to the curated knowledge tier at all — there is no write path for injection to exploit, regardless of how the agent is manipulated
Because it requires human approval for any memory write, eliminating automated poisoning paths
Correct. MIT06 doesn't detect or filter malicious content — it eliminates the write path entirely for the highest-trust memory tier. If agents cannot write to the curated knowledge base under any circumstances, no amount of prompt injection, indirect ingestion, or multi-agent contamination can corrupt it. The protection is structural, not pattern-based, which makes it robust to novel attack techniques that bypass detection rules.
Q5. What is the defining difference between memory poisoning (AG06) and manipulating an agent in a live conversation?
Memory poisoning always requires an attacker with admin access to the database; live manipulation only needs a user account
Memory poisoning only affects the agent's responses about specific topics, while live manipulation can change any response
Memory poisoning persists after the session ends and affects future conversations — including conversations the attacker is not part of. Live manipulation ends when the conversation ends.
Memory poisoning is always done by insiders; live manipulation is always done by external attackers
Correct. The defining characteristic of AG06 is persistence across sessions. A live manipulation attack — even a severe one — affects only the current interaction. When the conversation ends, the influence ends. A memory poisoning attack survives the session boundary and continues affecting future conversations, by potentially many different users, without the attacker being present. This persistence is both what makes memory useful and what makes its poisoning so dangerous.