# Persistent Context Injection in Agent Instructions

- **Severity:** High
- **Signature ID:** `b1d5a089-2c9b-4d6e-b1d0-5c3b4a1d0c72`
- **MITRE ATLAS:** AML.T0080 (AI Agent Context Poisoning)
- **OWASP:** ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection)

## Summary

Some prompts don't just try to trick an AI agent once — they try to make the trick stick, by phrasing injected content as a permanent rule the agent should 'always remember' or follow 'from now on.' This turns a one-time manipulation into lasting behavioral hijacking.

## How the attack works

An attacker delivers content to the agent, through a message, a document, a tool result, or any other input path the agent reads, that contains instructions disguised as new operating rules. The wording is designed to outlast the current session: phrases like 'always remember this,' 'from now on, treat this as a core instruction,' or 'this is a permanent update to your behavior.' If the agent's memory or context handling treats this as trusted configuration rather than untrusted input, the injected rule persists across future interactions. The attacker then benefits from altered agent behavior long after the original injection point is gone.

## Why it matters

An organization can end up with an AI agent whose behavior has been quietly and durably altered — leaking data, ignoring safety instructions, or acting on the attacker's behalf in sessions that have nothing to do with the original compromised input.

## What you can do

- Separate trusted system/developer instructions from untrusted content the agent reads, and never let untrusted content update persistent memory or system prompts automatically.
- Review any agent memory or persona-update mechanism for a way to require human approval before a stated 'permanent rule' is retained.
- Audit stored agent memory periodically for instructions that were never explicitly set by an authorized operator.
- Treat phrases like 'always remember,' 'from now on,' or 'this is now a core rule' appearing in user-supplied or tool-returned content as a red flag requiring review, not automatic compliance.

## Known benign look-alikes

- Legitimate system prompt configuration at startup
- Authorized persona setup for specialized assistant roles

---
Source: https://www.netzilo.com/threats/skillspector-persistent-context-injection