Threat T1

Memory Poisoning

Attackers inject malicious data into the agent's memory to manipulate future decisions, affecting any memory type from in-agent session to cross-agent cross-user memory.

9/10 risk (Critical)
6 attack vectors
7 mitigating controls
7 framework refs

Open in Threat Modeler All threats

Overview

Impact level: High
Risk score: 9/10 (Critical)
CIA impact: Confidentiality, Integrity
Affected components: Memory Modules (KC4.1-KC4.6)
Tags: memory, injection, RAG, persistence, knowledge-base
Source: OWASP Agentic AI T&M v1.1 (2025-12)

Attack vectors

How attackers carry out memory poisoning against an agentic system.

Attack vector	Severity	Example
Data Injection	High	Injecting malicious payloads into session memory
Context Manipulation	Medium	Altering agent's context window to bias outputs
Session Contamination	Medium	Cross-session poisoning via shared memory
Poisoned RAG sources	High	Supplying tainted data to retrieval-augmented generation
Training Data Corruption	High	Systematically poisoning knowledge bases with subtle biases
Memory Persistence Attacks	Medium	Creating malicious memories that persist across sessions

Affected components

KC4 Memory Modules

Mitigating controls

Controls from the catalog that reduce the likelihood or impact of T1.

M1 Memory Validation & Sanitization
Implement comprehensive validation and sanitization of AI memory systems, including vector databases, embeddings, and training data to prevent poisoning attacks and ensure data integrity throughout the AI lifecycle.
M4 Prompt Hardening & Jailbreak Prevention
Implement multiple layers of prompt security including structural defenses, behavioral constraints, runtime detection, and advanced techniques to prevent prompt injection, model manipulation, and jailbreaking attempts.
M5 Multi-Stage Reasoning Validation
Implement comprehensive validation of agent reasoning processes using multiple checkpoints, external validators, consistency checks, and fact verification to ensure goal alignment, prevent manipulation, and detect hallucinations.
M11 Content Security & Output Filtering
Implement comprehensive filtering and validation of agent outputs to prevent harmful content generation, data leakage, manipulation attempts, and ensure compliance with security policies and regulatory requirements.
M12 Secure Model Training & Validation
Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M17 Supply Chain Security & Provenance
Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.

Framework mappings

OWASP Top 10 for Agentic Applications

ASI06 Memory & Context Poisoning

Cisco AI Security Taxonomy

OWASP AIVSS core risks

AIVSS #8 Agent Memory and Context Manipulation AIVSS 8.9 (High)
AIVSS #5 Agent Cascading Failures AIVSS 9.4 (Critical)
AIVSS #10 Agent Goal and Instruction Manipulation AIVSS 7.1 (High)

OWASP AISVS

Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C2 Input Validation, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C7 Model Behavior, Output Control & Safety Assurance, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection.

Requirements: C8.1.3, C8.2.1, C8.2.2, C8.2.3, C8.2.4, C8.2.5, C8.3.1, C8.3.2, C8.3.3, C1.1.3, C1.1.4, C1.3.1, C2.1.3, C2.1.4, C12.5.4, C2.1.1, C2.1.2, C2.1.6, C2.1.7, C2.1.8, C11.1.3, C12.2.1, C12.2.3, C7.1.3, C7.2.1, C7.2.2, C7.2.3, C7.4.3, C9.2.6, C9.2.7, C7.1.1, C7.1.2, C7.3.1, C7.3.2, C7.3.3, C7.3.4, C2.2.1, C5.2.4, C11.2.1, C1.3.5, C3.2.1, C3.2.2, C3.5.1, C3.5.2, C11.1.1, C11.1.2, C11.2.4, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C4.1.1, C6.1.4, C6.1.1, C6.1.2, C6.1.3, C6.2.1, C6.2.2, C6.2.3, C3.1.2, C3.1.3, C1.1.2.

MITRE ATLAS

AML.T0018 Manipulate AI Model
AML.T0020 Training Data Poisoning
AML.T0051 LLM Prompt Injection
AML.T0054 LLM Jailbreak
AML.T0061 LLM Prompt Self-Replication
AML.T0070 RAG Poisoning
AML.T0092 Manipulate User LLM Chat History
AML.T0115 Publish Poisoned AI Artifacts
AML.T0115.000 Publish Poisoned AI Artifacts: Datasets

Attack walkthroughs

Travel Booking Memory Poisoning: An attacker keeps reinforcing a fake flight price; the assistant stores it as truth, then approves bookings at that price and bypasses payment checks.
Context Window Exploitation: The attacker splits attempts across sessions so earlier rejections drop out of context, and the AI eventually grants escalating permissions up to admin access.
Shared Memory Poisoning: The attacker inserts bogus refund policies into shared memory; other agents reuse them, causing bad decisions and financial losses.
Assistant Memory Poisoning: An attacker implants a user assistant's memory via Indirect Prompt Injection, compromising current and future sessions.
T1 (Memory Poisoning) in Sequential: While the KC4.1 memory is session-specific, it can still be poisoned by malicious input.
T1 (Memory Poisoning) in Collaborative Agent Swarm: This threat is amplified in a swarm architecture.
T1 (Memory Poisoning) via RAG Poisoning in Knowledge-Intensive: The primary attack vector is injecting malicious content into the knowledge base or RAG data sources.

References

Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11