OWASP Top 10 for LLM & Generative AI Applications — ASI06: Memory & Context Poisoning (OWASP Foundation, 2026 Edition). The authoritative definition, risk description, and mitigation framework for this risk category.

Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injections — Greshake et al., arXiv:2302.12173 (2023). Established indirect prompt injection as a distinct, exploitable attack class against LLMs integrated with external data sources.

Persistent Memory Injection via Long-Term Memory Feature — Johann Rehberger / embrace-the-red.com (2024). Demonstrated cross-session memory persistence attack against ChatGPT's memory feature via indirect prompt injection through processed documents.

Poisoning Web-Scale Training Data — Carlini et al. (2023). Background on data poisoning principles that underpin RAG poisoning attacks at scale.

OWASP Application Security Verification Standard (ASVS) — V8 (Data Protection) and V1 (Architecture) requirements apply to memory isolation and access controls. NIST AI RMF — Govern, Map, Measure, and Manage functions apply to memory system risk management. ISO/IEC 27001 — Information security controls for data integrity and access management are directly applicable to agent memory stores.