Memory poisoning doesn't happen in the conversations it affects. The attack happens once — at write time. Everything after is the agent faithfully acting on a planted belief.

Persistence is the defining risk. A single poisoning event can silently affect every conversation that retrieves the poisoned entry — potentially hundreds or thousands — until the entry is found and removed.

The indirect ingestion channel is the most common attack path. Attackers don't need database access — they need to control content the agent will process and store.

Memory tier separation (MIT06) is the highest-leverage control: agents cannot write to the curated knowledge base, so no injection technique can corrupt it.

Cross-user memory leakage (Type 6) requires database-level namespace isolation — application-layer filtering can be bypassed by prompt injection that instructs the agent to query without the filter.

Multi-agent memory contamination propagates horizontally: one poisoned write to a shared store corrupts the beliefs of every agent that reads from it — the blast radius scales with the number of agents in the pipeline.