Agent Memory and Identity Manipulation
Some AI agents keep memory or state between sessions so they remember context. This rule flags instructions that try to overwrite that stored memory, reset the agent's identity, or plant false 'memories' that persist and affect future sessions.
How the attack works
An attacker sends the agent input crafted to look like a system instruction, memory update, or identity reset rather than a normal request. If the agent accepts it, the injected content gets written into its persistent memory or state instead of being treated as a one-off message. In later sessions the agent then acts on the poisoned memory, effectively behaving as if the attacker's instructions were legitimate configuration or past history.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- c0e4b978-1d8f-4e5c-b0e9-4d7f2e9c8a61
- Severity
- High
Why it matters
An organization can end up with an agent whose long-term behavior, role, or trust boundaries have been silently altered, causing it to act on attacker-controlled instructions across future sessions rather than just the current one.
What you can do
- →Restrict who and what can write to the agent's persistent memory or configuration state, separate from normal conversational input.
- →Require explicit authorization checks before any session reset or identity/role reconfiguration is applied.
- →Log and review memory writes and identity changes, especially ones triggered by user-supplied text rather than admin tooling.
- →Treat onboarding and reset flows as privileged operations and validate that the request source matches expected authorized users.
Known benign look-alikes
- Legitimate session reset commands from authorized users
- Onboarding flows that legitimately reconfigure agent role