Persistent memory makes an attack durable. An attacker who plants a false instruction or fact once, for example through a document the agent summarizes, can influence every later session and every user who shares that memory, long after the original input is gone.
Validate and attribute every memory write, separate memory by user and tenant, expire or re-verify stored facts, keep untrusted content out of persistent memory by default, and give operators tools to inspect and roll back memory.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2026Latest
#06asi06-2026 Memory and Context Poisoning
