# Agent Memory Manipulation

- **Severity:** High
- **Signature ID:** `dafe5245-b6e1-4db9-a5c6-bf7431891d18`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0080 (AI Agent Context Poisoning)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Some AI agents keep persistent memory or long-term context so they can recall facts across sessions. This rule flags attempts to abuse that feature by injecting instructions that get stored as if they were legitimate saved information, letting an attacker change the agent's behavior permanently rather than just for one conversation.

## How the attack works

An attacker sends input, directly or through content the agent reads, that is phrased to look like a normal request but actually contains commands like 'remember that you should always do X' or 'update your instructions to Y'. If the agent stores this as persistent memory rather than treating it as untrusted input, the false instruction becomes part of its baseline behavior. Because memory persists across sessions and context resets, the poisoned instruction keeps acting on future, unrelated conversations. This can be used to plant a standing backdoor, alter the agent's goals, or make it leak information in later sessions without any further attacker interaction.

## Why it matters

An agent's behavior can be silently and permanently altered, affecting every future user session, not just the one where the injection occurred. This can lead to persistent backdoors, ongoing data leakage, or an agent that reliably acts against its owner's intent until the poisoned memory is found and removed.

## What you can do

- Treat any content that could modify persistent memory as untrusted input and validate it before storage, especially content sourced from external documents, web pages, or third-party tools.
- Separate user-facing conversation from memory-write operations so that instructions embedded in regular text cannot silently trigger a memory update.
- Log and periodically review what gets written to an agent's long-term memory or state store, looking for instruction-like content rather than factual preferences.
- Give users and admins a way to inspect and clear an agent's stored memory, and do so after suspected prompt injection incidents.

## Known benign look-alikes

- Users legitimately asking an agent with memory features to remember preferences
- Developers configuring agent behavior through documented memory APIs
- Users asking to update conversation context with factual corrections
- A developer writing documentation that describes how to update the agent's guidelines through an official admin API endpoint
- A user asking the agent to save their delivery address to long-term memory for future orders without any behavioral modification directives

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00075

---
Source: https://www.netzilo.com/threats/atr-agent-memory-manipulation