Agent Persistent Memory Poisoning via Behavioural Modifier Injection
Some AI agents remember things across conversations by saving notes to a memory store. This detection flags attempts to write malicious instructions into that memory, disguised as normal preferences, so the agent behaves badly in every future session without the attacker needing to do anything else.
How the attack works
An attacker gets content into the agent's memory-write path, often through a prompt, a document the agent reads, or a manipulated conversation. That content includes instructions that try to change the agent's behaviour permanently, such as adopting a different persona or overriding its normal rules. It's combined with instructions to leak data, for example telling the agent to include sensitive information in future replies or send it elsewhere. If the write succeeds, the poisoned memory persists and gets recalled automatically in later sessions, so the agent keeps acting on the attacker's instructions indefinitely.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 043f4e6f-5354-5bc0-8046-ac279b2763ca
- Severity
- High
Why it matters
A single successful write can give an attacker a standing foothold in the agent's behaviour, causing ongoing data leakage or manipulated responses across all future sessions until the poisoned memory is found and removed.
What you can do
- →Review what content is allowed to be written to agent memory, and from what sources (user input vs. documents vs. tool outputs).
- →Require explicit user confirmation before persisting any behavioural or persona-changing instruction to long-term memory.
- →Periodically audit stored memories for instructions resembling persona overrides, jailbreak language, or data-exfiltration directives.
- →Distinguish legitimate personalization settings (language, formatting) from instructions that change the agent's rules or request it to disclose data, and treat the latter as high risk.
Known benign look-alikes
- Legitimate personalisation instructions written by the user themselves (e.g. respond in a preferred language, formatting preferences)
- Onboarding flows that persist user-approved behavioural preferences to the memory store during initial configuration