← All Terms

Memory and Context Poisoning

An attack that plants false or malicious content in an AI agent's memory or context so it keeps shaping the agent's behaviour in later sessions.

Agentic AI

Memory and context poisoning targets what an agent remembers. An attacker gets content into the agent’s long-term memory, shared context or retrieval store, and the agent then treats it as trusted background in later tasks, for other users, long after the original message has gone. OWASP lists it as ASI06 in its Top 10 for Agentic Applications.

It turns a one-off prompt injection into a lasting compromise. A stateless agent forgets the attack when the session ends. An agent with persistent memory carries it forward, which is why scoring frameworks treat persistence as a factor that raises the priority of the same flaw.

ISO/IEC 27090 makes the same point about models: data gathered in operation can become training data, so a corrupted input today can shape a future version. Controls follow from that. Validate what is written to memory, keep memory per session where possible, and give someone ownership of what the agent is allowed to remember.

Read more on this
Security

Agent-Aware Vulnerability Management Ranks Flaws by What the Agent Can Do

A vulnerability score describes a flaw. It says nothing about the AI agent standing behind it: how freely it acts, what it is allowed to touch, which tools it can call, what it remembers and which business process it runs. Agent-aware vulnerability management adds those five things to exploitability before deciding what to fix first. ISO/IEC 27090:2026, published in October, gives the threat side of the same picture. Here is how the two fit together and how to run it.