IoPC Taxonomy · T2 Data, Retrieval & Memory Poisoning

IOPC-T2.002 Persistent Memory Poisoning

Injection of adversarial content into an agent's durable memory (long-term memory stores, user profiles, episodic memory, learned preferences) so that it influences future sessions without a fresh injection.

How it differs

Distinguished from RAG Poisoning (T2.001) by the durable-state attack surface: the poisoned artifact lives in the agent's own memory and persists across sessions and users, so the blast radius and remediation differ (memory purge vs. index clean-up).

Status

active, evidence: curated incident, reviewed 2026-11-12.

Mapped to

• CSA Autonomous Action Runtime Management (AARM): T5 Memory Poisoning (related)
• MITRE ATLAS: AML.T0080 AI Agent Context Poisoning (narrower than)
• MITRE ATLAS: AML.T0080.000 AI Agent Context Poisoning: Memory (related)
• MITRE ATLAS: AML.T0080.001 AI Agent Context Poisoning: Thread (related)
• MITRE ATLAS: AML.T0092 Manipulate User LLM Chat History (related)
• OWASP Top 10 for Agentic Applications: ASI06 Memory & Context Poisoning (narrower than)
• OWASP Top 10 for LLM Applications: LLM05 Data and Model Poisoning (narrower than)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service