T1 (Memory Poisoning) in Sequential

How the attack unfolds

1. 1. The setup

   The target is a Sequential Agent Architecture. A straightforward linear workflow where a single agent processes tasks through a linear workflow. This design typically uses a single KC1.1 (Large Language Model) as its cognitive core, guided by a KC2.1 (Sequential workflow) and KC3.3 (Chain of Thought) reasoning.

2. 2. The attack

   While the KC4.1 memory is session-specific, it can still be poisoned by malicious input. This can corrupt the agent's immediate context, causing it to generate flawed or harmful outputs for the duration of the session.

   Threat T1 · Component KC4 · High

3. 3. Technique: Training Data Corruption

   Systematically poisoning knowledge bases with subtle biases. The threat catalog rates this T1 vector high.

   Threat T1 · Component KC4 · High

4. 4. Threat: T1 Memory Poisoning

   T1 Memory Poisoning: Attackers inject malicious data into the agent's memory to manipulate future decisions, affecting any memory type from in-agent session to cross-agent cross-user memory.

   Threat T1 · Component KC4 · High

5. 5. In the wild: Shared Memory Poisoning

   ASI06 Memory & Context Poisoning in the OWASP Top 10 for Agentic Applications describes the same pattern: The attacker inserts bogus refund policies into shared memory; other agents reuse them, causing bad decisions and financial losses.

   Threat T1 · Component KC4 · High

Threats involved

• T1 Memory Poisoning: Attackers inject malicious data into the agent's memory to manipulate future decisions, affecting any memory type from in-agent session to cross-agent cross-user memory.

Controls that stop it

• M1 Memory Validation & Sanitization

  Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.

• M4 Prompt Hardening & Jailbreak Prevention

  Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.

• M5 Multi-Stage Reasoning Validation

  Implement comprehensive validation of agent reasoning processes using multiple checkpoints, external validators, consistency checks, and fact verification to ensure goal alignment, prevent manipulation, and detect hallucinations.

• M11 Content Security & Output Filtering

  Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.

• M12 Secure Model Training & Validation

  Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.