Direct Memory Plant Command — Persistent Fact or Code Storage Injection
This rule flags requests that explicitly ask an AI agent to store a fact, personal detail, or secret code in its persistent memory so it can be recalled in a later session. On its own this is normal assistant behavior, but it can also be used to plant data that gets pulled back up later for social engineering or to poison the agent's context.
How the attack works
An attacker (or a malicious input embedded in content the agent processes) issues an explicit instruction such as 'remember this' or 'store this for future reference,' paired with a piece of information like a name, code word, or credential-like string. The agent writes this into its long-term memory store. In a later, unrelated session, the agent may retrieve and act on this planted fact, treating it as trusted prior context. This differs from memory-poisoning attacks that try to change the agent's behavior directly — here the goal is simply to get specific data persisted and later surfaced.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a934896c-a9fd-4bad-a254-5dbb5a9a0697
- Severity
- Medium
Why it matters
An organization could have sensitive data or misleading facts quietly seeded into an agent's memory, later resurfacing to enable social engineering, credential misuse, or corrupted decision-making in future conversations.
What you can do
- →Review what triggers persistent memory writes and require explicit user confirmation before storing personal data or code-like strings.
- →Periodically audit stored memory entries for secrets, codes, or unexpected personal data.
- →Separate memory written by trusted users from memory derived from untrusted or external content the agent processes.
- →Set expiration or review policies for persisted facts so old, unverified entries don't silently influence future sessions.
Known benign look-alikes
- Legitimate assistant memory features where users store personal preferences
- Note-taking agents designed to remember user-specified information
- Legitimate code storage/retrieval assistant features