The attack requires no privileged access. The attacker does not compromise a server, steal a credential, or reach the database where an agent keeps what it has learned. They send the agent queries, of the sort any legitimate person might send, and they read the replies.
Shen Dong, Pengfei He, Jiliang Tang and Hui Liu published the method in 2025 under the name MINJA. Across the agents and datasets they tested, the technique wrote adversarial records into long-term memory with an average injection success rate of 98.2 per cent, and those records subsequently produced the attacker's intended behaviour 76.8 per cent of the time. Injection succeeded above 95 per cent everywhere they tried it.1
The agent's ordinary performance barely degrades. It continues answering other questions correctly, at normal quality, for anyone who is not the target of the planted record. There is no period of visible malfunction that would prompt somebody to look.
I should say plainly that we build governance and agent infrastructure, and that provenance is a feature of what we are building, which makes this an argument I have an interest in winning.
ASI06
In December 2025 the OWASP Gen AI Security Project published its Top 10 for Agentic Applications, and gave this class of attack its own identifier: ASI06, Memory and Context Poisoning. It covers adversarial content written into anything an agent will consult later, which in practice means retrieval stores, vector databases, conversation history and shared context.2
The categorisation is doing real work, because it separates this from the thing it superficially resembles. Prompt injection, which the earlier list covers as LLM01, is bounded by the session. The malicious instruction arrives, does its damage, and the session ends. Memory poisoning does not end. The content persists across sessions, across restarts, and across redeployments where the underlying store is not wiped, which it generally is not, because wiping it would discard the thing the memory exists to accumulate.
OWASP identifies the property that makes this hard as temporal decoupling: the moment the attack is planted and the moment its effect appears are separated, potentially by weeks.3
That separation is not an inconvenience. It is the whole problem, and it invalidates the defensive instinct that the industry has brought to almost every other class of attack.
Why detection is the wrong build
The instinct is to inspect the write. Look at what is about to enter memory, decide whether it is malicious, and refuse it if it is.
This fails for a reason that has nothing to do with the quality of the classifier. At the moment of the write there is frequently nothing to detect. The record MINJA plants is not a hostile instruction sitting in plain view. It is a plausible-looking observation, derived from an interaction that genuinely occurred, which becomes harmful only in combination with a query that arrives later and which the system has not yet seen. Judged on its own, at the moment it is written, it is unremarkable.
The second failure is more general and applies even to obviously bad content. A detector positioned at the write has to make an irreversible decision with the least information it will ever have. Everything that would establish the record as harmful, the pattern of what it is later used to justify, the queries it turns out to answer, the other records it accumulates alongside, exists only in the future.
The industry has built this way before and knows how it goes. Signature-based malware detection worked while the population of threats was small and static, and stopped working when it was neither. What replaced it was not a better signature database. It was the recognition that you cannot enumerate badness in advance, and that the useful investment is in being able to reconstruct what happened afterwards.
Memory poisoning is a stronger version of the same lesson, because here the delay is not an accident of detection. It is engineered by the attacker.
Five point four per cent
There is a field which has run the experiment of what happens when bad information enters a shared body of knowledge and a correction is issued afterwards. It is not a hypothetical, the correction mechanism is formal and mandatory, and the results are not encouraging.
When a scientific paper is retracted, the retraction is published, indexed, and attached to the record. Anyone checking can find it. The question is whether anyone checks.
A study of biomedical literature examined 13,252 citation contexts in which a retracted paper was cited after its retraction. In 722 of them, amounting to 5.4 per cent, the citing text acknowledged that the paper had been retracted.4 In the remaining 94.6 per cent, the retracted work was cited as though it still stood.
Other measurements agree on the shape. In anaesthesiology and intensive care medicine, 46 per cent of retracted articles were cited at least once after retraction. An examination of 587 systematic reviews and clinical practice guidelines found 135 citations of retracted randomised controlled trials made after the retraction, of which 6 per cent noted it. Roughly 30 per cent of retracted papers turn up in at least one systematic review, which is the document type specifically intended to summarise reliable evidence.5
Science therefore has the feature that agent memory does not: a formal, authoritative, published mechanism for saying that a piece of knowledge has been withdrawn. And it makes almost no difference, because the mechanism corrects the source and nothing carries the correction to the places that consumed it.
This is the failure mode agent memory should expect, and it should expect it worse. A systematic review at least cites the paper it drew on, which means the link exists even when nobody follows it. When an agent distils a hundred observations into a summary, and the summary is later distilled again, the intermediate records are frequently discarded as an optimisation. Nothing points back. Discovering that one of the original hundred was planted tells you nothing about which of the surviving summaries is now wrong.
Article 18
The industry that solved this did not solve it with detection either.
European food law has required traceability since Regulation (EC) No 178/2002. Article 18 obliges every operator, at every stage of production, processing and distribution, to be able to identify who supplied them and who they supplied.6 The convention has a name that describes it exactly: one step back, one step forward. Nobody has to hold a map of the entire chain. Each participant holds two links, and the chain reconstructs when somebody needs it to.
What is notable is the ambition. The regulation does not require operators to detect contamination. It assumes contamination will occur and will be discovered downstream, sometimes long after the product has dispersed. The requirement is that when it is discovered, everything derived from the affected batch can be identified and recalled.
The design accepts the failure and invests entirely in the response. Given that most contamination is not visible at the point it enters the chain, that is the only investment with a return.
Transposed to memory, the obligation is legible enough. Every record an agent writes identifies where it came from: which interaction, which source, which model or person produced it, under what authority. Every record derived from other records identifies which. A summary knows what it summarised. An index knows what it indexed. When a record is later found to be false, whether planted or simply wrong, everything downstream of it can be found, because the links were recorded at the time rather than reconstructed afterwards.
That is a recall system. It does not prevent poisoning any more than Article 18 prevents contamination.
What a memory record would carry
Four fields, none of them exotic, all of them cheap at write time and impossible to add retrospectively.
Where this came from. The interaction, document or system it originated in. Not a category, a specific reference.
Who produced it. Whether a person wrote it deliberately, an agent inferred it, or a process imported it. These warrant different confidence and a store that flattens them has discarded what a reviewer needs first.
What it was derived from. For anything computed rather than observed, the identifiers of the records it came from. This is the one that costs discipline rather than storage, because it must survive every summarisation, and summarisation is exactly where systems currently discard it.
Whether anyone has confirmed it. A record that a person has checked and one that has merely never been questioned are different objects, and only one of them should be allowed to influence a consequential decision.
None of this is novel. It is what a laboratory notebook does, what a chain of custody does, and what Article 18 requires of a business selling tinned fish. What is novel is applying it to a store that writes itself continuously, at machine speed, from inputs an attacker can influence.
Forging the origin
There is an objection to all of this that deserves stating rather than burying, because it is the first one a security reviewer will raise.
If the attacker can influence what gets written, can they not also influence the provenance attached to it? In the general case, yes. A record whose origin is recorded by the same component the attacker manipulated inherits the manipulation. Provenance written by an untrusted party is a claim about a claim.
Two things reduce this without eliminating it. Provenance recorded by the layer that observes the interaction, rather than by the agent participating in it, is harder to influence, because the attacker would need to compromise the observer rather than merely converse with the agent. And provenance that is signed and append-only makes retrospective editing detectable, which is a weaker property than preventing the write but a considerably more useful one than nothing, since the attack we are discussing is discovered retrospectively by definition.
The honest position is that provenance raises the cost of an attack and makes its aftermath tractable. It does not make the attack impossible, and any account claiming otherwise is selling something.
What this does not fix
Three further limits.
Provenance establishes where a claim came from, not whether it is true. A perfectly attributed record can be wrong, and knowing that an agent inferred something on a Tuesday does not tell you whether the inference was sound. What it gives you is the ability to act on a finding once somebody else establishes it.
Propagating a retraction through derived material is unsolved in practice. Knowing that a summary drew on a poisoned record tells you the summary is suspect. It does not tell you whether the poisoned part is the part that mattered, and recomputing everything downstream of a withdrawn record is expensive enough that organisations will be tempted to flag rather than rebuild. The retraction literature suggests exactly how well flagging works.
And nobody has published, as far as I can find, a measurement of how much provenance capture costs at production write rates or what proportion of real incidents it actually resolves. The argument here is from failure modes and from the experience of other fields, not from a study of this one, because the practice is too young to have produced one.
Building the recall before the contamination
Having spent time on European cybersecurity regulation while writing about NIS2 and the Cyber Resilience Act at the end of last year, the thing that struck me was how much of the regime is concerned with what happens after, rather than with prevention. Incident reporting timelines, board accountability, obligations that attach once something has already gone wrong. That reads as pessimism until you notice it is the only part of a security regime that can be specified precisely, because prevention depends on the threat and response does not.
The same asymmetry applies here, and it has an unusual consequence for the order of work. Provenance is worth almost nothing on the day you build it. It produces no dashboard, blocks no attack, and satisfies no auditor who has not yet had an incident. Its entire value is realised on a day that may not come for two years, and it can only be collected if it was captured continuously in the interim. There is no way to add it later, because the thing you need is a record of events that have already happened.
That is a difficult thing to fund and an easy thing to defer, and it is the reason food traceability had to be legislated rather than adopted.
The write you will not notice
The uncomfortable implication of the MINJA results is not that agent memory can be poisoned. Any store that accepts writes can be poisoned, and this has been true of every system that has ever learned from its inputs.
It is that the write is indistinguishable from ordinary use, the agent continues working normally, and the effect appears at a time and in a context the attacker chose. Every property that would trigger an alert has been engineered away, and they were engineered away by a technique that assumes the attacker can do nothing except talk to the system like anybody else.
The organisations that handle this well will not be the ones with the best detection. They will be the ones that can answer, when something eventually surfaces, where a particular belief came from and what else was built on it. That question has a good answer or a bad one depending on decisions taken long before anybody thought to ask it.
One step back, one step forward. It was sufficient for the food supply, it was arrived at by an industry that had exhausted the alternatives, and there is no obvious reason a memory store deserves a weaker standard than a tin of fish.
Footnotes
-
Shen Dong, Pengfei He, Jiliang Tang and Hui Liu, "A Practical Memory Injection Attack against LLM Agents," arXiv:2503.03704, also circulated as "Memory Injection Attacks on LLM Agents via Query-Only Interaction." The reported average injection success rate is 98.2 per cent with an average attack success rate of 76.8 per cent, exceeding 95 per cent injection success across all agents and datasets tested. The threat model restricts the attacker to submitting queries and observing outputs. Related work on defences appears as arXiv:2601.05504. ↩
-
OWASP Gen AI Security Project, Top 10 for Agentic Applications, published December 2025. ASI06 covers Memory and Context Poisoning across retrieval stores, vector databases, conversation history and shared context. ↩
-
OWASP Gen AI Security Project, "Memory Is a Feature. It Is Also an Attack Surface," May 2026, which sets out persistence and temporal decoupling as the structural properties distinguishing this class from session-bounded prompt injection. ↩
-
"Continued use of retracted papers: Temporal trends in citations and (lack of) awareness of retractions shown in citation contexts in biomedicine," Quantitative Science Studies, MIT Press. Of 13,252 post-retraction citation contexts examined, 722 acknowledged the retraction. ↩
-
Figures drawn from the retraction literature across several specialties. The 46 per cent figure is from a study of anaesthesiology and intensive care; the 587-review figure and its 6 per cent acknowledgement rate from an examination of systematic reviews and clinical practice guidelines citing retracted randomised controlled trials. These are separate studies with differing methods and the proportions are not directly comparable; they are cited here for consistency of direction rather than as a combined estimate. ↩
-
Regulation (EC) No 178/2002, Article 18. Operators must be able to identify their immediate suppliers and immediate customers, the convention known as one step back, one step forward, with systems and procedures capable of delivering that information to competent authorities on request. ↩