Poison an agent's memory once, and it drifts forever.

A team builds an agent with memory done properly. They read the architecture post and they followed it: working, episodic, and semantic tiers as distinct stores; a consolidation pass at the end of each session that summarizes what happened and promotes the durable facts; an as_of date on everything. It is a real memory system, not a vector store with delusions.

Then, in one session, an attacker gets a single false fact written — through a poisoned tool result, or a crafted user turn engineered to read as a stated preference. It is one record among thousands. Nobody notices.

Months later the agent is still acting on it, and the situation is worse than “a wrong fact in the database.” The consolidation pass did its job. It found the false fact in episodic memory, judged it durable, and promoted it to semantic memory — and in promoting it, it did what promotion does: it stripped the episode. The fact no longer carries the session it came from, the turn that introduced it, or any trace that its origin was a single unverified event. It is now a clean, dated, sourceless entry in the highest-trust tier, indistinguishable from a fact the agent learned honestly across a hundred interactions. The lie was not caught by time. It was promoted by design.

Consolidation is also a trust-laundering step

The architecture post made the case for consolidation, and the case is correct. Raw interaction logs grow without bound and drown the agent in transcript; a consolidation pass that compresses a thousand turns into fifty episodes into five durable facts is what separates memory from an append-only log. Promotion from episodic to semantic memory deliberately strips the episode — “preferred region: EU” is the useful artifact, not “on May 2nd the user said, while talking about something else, that they prefer the EU region.” Stripping the episode is the feature.

Now look at the same step through a security lens. Consolidation takes an input and produces an output, and the two differ in exactly two properties. The input is a raw event: low-trust, and carrying its provenance — which session, which turn, which source. The output is a semantic fact: high-trust, sitting in the tier the agent reasons from most readily, and carrying no provenance at all, because provenance is what got stripped.

For an honest event that transformation is harmless and useful. For a poisoned event it is laundering. The poisoned write enters as what it is — one unverified record from one session — and exits as a trusted, sourceless, durable fact. The consolidation pass cannot tell the difference, because its job was never to establish truth. Its job was to compress, and it compresses a lie exactly as efficiently as a fact.

One write, because memory persists and re-trusts

It is worth being precise about why this is a different threat from the prompt injection it resembles, because the difference is the entire reason it deserves its own post.

A classic prompt injection, the kind our taxonomy maps, is scoped to a session. The hostile text rides into the context window, it does its damage in that exchange, the session ends, and the context window is gone. The attack is real and serious, and it is also transient — to keep hurting you, the attacker has to land it again.

Memory poisoning removes the transience, on two axes at once. The first is persistence: a poisoned memory write is a prompt injection that does not end with the session, because the whole point of memory is to survive the session. The second is the one teams miss — re-trust. The architecture does not merely store the poisoned write; it re-evaluates it at consolidation and elevates it. A stateless injection has to be re-landed. A poisoned memory write is re-landed for the attacker, by the agent’s own consolidation pass, every cycle, with its trust raised each time. One write is enough because the system finishes the job.

What the poisoning attacks demonstrate

The literature has moved this from argument to measurement, and three results matter.

The first is feasibility. Memory Injection Attacks on LLM Agents via Query-Only Interaction (arXiv 2503.03704) introduces MINJA, and the name of the threat model is the finding: query-only. The attacker needs no access to the memory system, no compromised tool, no special privilege — only the ability to send the agent normal user queries. Through ordinary interaction they get malicious records written, records that later trigger harmful reasoning when the agent retrieves them. The barrier to entry is a conversation.

The second is persistence. MemoryGraft (arXiv 2512.16962) implants malicious experiences into an agent’s long-term memory and exploits the fact that agents imitate the patterns of retrieved successful tasks. Its result is the word in this post’s title: poisoned memory records persistently alter agent behavior across multiple sessions, producing significant behavioral drift whenever the agent later meets a semantically similar task. The poison does not sit inert. It is retrieved, imitated, and compounded.

The third quantifies where memory sits among the options. BackdoorAgent (arXiv 2601.04566) studies backdoor attacks across three stages of an agent’s workflow — planning, memory, and tool use — and measures how reliably an injected trigger persists in each. On GPT-based systems the trigger persisted 43.58% of the time in planning-stage attacks, 60.28% in tool-stage attacks, and 77.97% in memory-stage attacks. Memory is the most persistent stage by a wide margin. If you are an attacker choosing where to plant something, the memory is the answer, and the measurement says so.

Why forgetting and supersession do not save you

The architecture post gave memory three ways to forget: supersession, decay, and deletion on request. It is worth walking each one against a poisoned semantic fact, because the reassuring intuition is that one of them will eventually clear it, and none of them does.

Decay ages out episodic memory on a recency-and-usage score. But the architecture post is explicit that semantic facts do not decay on a timer — they are superseded or deleted, not aged out. A poisoned write that has been promoted to semantic memory has left the only tier decay governs. Time does not touch it.

Supersession retires a fact when a newer fact contradicts it. This works for honest staleness — a region preference that genuinely changed. It does not work for a poisoned fact, because a poisoned fact is usually not wrong about a value that later changes; it is a fabricated claim with no honest counterpart on its way. Nothing arrives to contradict it, so nothing supersedes it.

Deletion on request is a real and clean operation — but it requires someone to know the fact is poisoned and name it for deletion. The fact has had its provenance stripped by consolidation. There is nothing about it that looks wrong. The one mechanism that could remove it is gated on a discovery the architecture has actively made harder.

Three valves, and a poisoned semantic fact flows past all three. That is not a gap in the forgetting policy. It is the forgetting policy working as designed on an input it was never designed to catch.

Defending tiered memory

The fix is not to abandon tiered memory — the architecture is right, and a flat vector store is poisonable too, with fewer defenses available. The fix is to add a poisoning threat model to it.

Carry provenance through consolidation. The architecture post put an as_of date on every fact to handle staleness. Add two more fields and refuse to strip them on promotion: a source and a trust level. A promoted fact should still know it came from one unverified event, so that a fact backed by a hundred consistent episodes and a fact backed by a single tool result are not stored as equals.

Treat memory writes as untrusted input. The write path is an injection surface, and it gets the same default the prompt-injection taxonomy assigns every other channel: nothing the agent ingests is trusted by default, and that includes what it ingests into its own memory.

Gate promotion with a detector. Do not let consolidation promote a fact to semantic memory unscreened. A-MemGuard (arXiv 2510.02373) uses consensus-based validation and a dual-memory structure to flag adversarial records and reports over 95% attack-success-rate reduction; SuperLocalMemory (arXiv 2603.02240) applies Bayesian trust scoring with architectural isolation and degrades a sleeper-attack record’s trust by 72%. Both leave a residual — promotion screening is a smoke alarm, not a sprinkler — but a screened promotion path is the single highest-leverage change.

Allow invalidation by provenance, not only by supersession. If a source is later found to be compromised, every fact promoted from it must be revocable on that basis — without waiting for a contradicting fact that, for a fabrication, never comes.

Put memory poisoning in the regression suite. Plant a poisoned fact, run the agent through several sessions and a consolidation cycle, then assert the fact did not persist and did not get promoted. This is the stale-fact regression test from the architecture post, pointed at an adversary instead of at drift.

Watch for cross-session compounding. A poisoned fact reveals itself as drift over time, and drift over time is exactly what agent-native observability is for — trace sampling and a human reading transcripts will catch a behavioral shift that no single session looks wrong enough to flag.

The checklist

Before you trust an agent’s memory:

• Every stored fact carries a source and a trust level, and consolidation preserves them on promotion rather than stripping them.
• The write path treats memory writes as untrusted input, by default.
• A detector screens facts before they are promoted to semantic memory; nothing is promoted unscreened.
• A poisoned semantic fact can be invalidated by its provenance, not only superseded by a newer fact.
• A memory-poisoning regression test exists: plant a poisoned fact, run sessions, assert it neither persists nor is promoted.
• Cross-session behavioral drift is monitored, because a poisoned fact shows up as drift and not as a single bad turn.
• A right-to-be-forgotten purge can remove a poisoned fact from all three tiers in one operation.
• Someone has accepted that screening is mitigation, not closure, and designed for the records that get through.

A stateless prompt injection is a fire you put out. A poisoned memory write is a fire the agent carries into the next room, and the next, relighting it at every consolidation pass — because the architecture was built to make facts durable, and it cannot tell which facts deserve to be.

Reading list

• Memory Injection Attacks on LLM Agents via Query-Only Interaction (arXiv 2503.03704) — MINJA; the attacker needs only ordinary queries, no access to the memory system, to get a malicious record written.
• MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval (arXiv 2512.16962) — poisoned experiences produce behavioral drift across multiple sessions whenever the agent meets a semantically similar task.
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents (arXiv 2601.04566) — trigger persistence measured across stages: 77.97% in memory-stage attacks, well above planning and tool use; memory is the most persistent place to plant something.
• A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory (arXiv 2510.02373) — consensus-based validation and a dual-memory structure, with over 95% attack-success-rate reduction; a model for the promotion gate.
• SuperLocalMemory: Privacy-Preserving Multi-Agent Memory with Bayesian Trust Defense Against Memory Poisoning (arXiv 2603.02240) — Bayesian trust scoring and architectural isolation as a poisoning defense; read it for trust as a first-class, decayable property of a stored fact.

Memory is what makes an agent useful past the length of one conversation. It is also what makes one bad write permanent. Build the second half of that sentence into the design, because the first half guarantees it.