Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Agent memory

Also called: memory poisoning · persistent memory

Agent memory is information an AI assistant or agent stores between sessions, such as user preferences, facts and past conversations, and reloads into its context later. If an attacker can write to it, injected instructions persist and keep influencing the agent long after the original attack.

How it works

Memory can be poisoned through prompt injection that asks the agent to remember something, through shared memory stores, or through third-party memory plugins and packages. Stored memories can also hold sensitive data that later leaks.

How to defend

Let users see and delete memories, restrict which content may write to memory, treat recalled memory as untrusted input, and vet memory plugins like any other dependency.

Real cases 3 stories

  1. HIGH

    Vulnerability · Zenity Labs

    AgentCorruption: one prompt takes over Bedrock AgentCore agents

    AgentCorruption is a chain Zenity Labs demonstrated against Amazon Bedrock AgentCore, where one prompt to an exposed agent yields IAM credentials and then control of every AgentCore agent in the same AWS account and region.

  2. MED

    Vulnerability · LangChain · CVE-2026-106119 · CVSS 6

    LangChain MongoDB chat history: query injection crosses sessions

    CVE-2026-106119 lets an attacker who controls a session identifier read, change or delete another user's chat history in @langchain/mongodb. The library passed the identifier into a MongoDB query without enforcing a string type.

  3. HIGH

    Supply chain · Socket

    MemTensor MemOS packages compromised with a credential stealer

    Malicious releases of MemTensor's MemOS packages on npm and PyPI shipped sckit, a Go credential stealer that runs on import and sends npm, PyPI, GitHub, cloud and SSH secrets to skyleen[.]fr. Safe versions: npm 0.1.20, PyPI 2.0.33.