Agent Memory Poison Hit Up to 71% of Runs

A single malicious instruction slipped into one tool result went on to steer AI agents in later, unrelated sessions in up to 71% of test runs, according to a benchmark that researchers from Microsoft and Rensselaer Polytechnic Institute posted to arXiv on Nov. 6. The preprint, MemoryDojo, tested five open-source agent memory systems and found none immune.

Key takeaways

• All five systems tested (A-MEM, Graphiti, Letta, Mem0 and Memora) let poisoned instructions influence later tasks.
• Payloads tuned to a specific memory design raised the share of later tasks affected by about 2 to 31 percentage points.
• Long benign histories blunted the attack: the task-level hit rate fell to 5.32% or lower, though Memora was still reached in 45.16% of runs.

How agent memory poisoning works

Agents use memory to carry facts and preferences across sessions after the original context is gone. That same feature can turn a one-off prompt injection into standing behavior. The authors give the example of an email falsely stating a user preference to forward invoices: without memory, one invoice might leak; with memory, the rule could apply to every future invoice.

In the benchmark, the attacker controls only the content returned by one external tool call. The system prompt, user requests and memory software stay untouched, and the poison is added once.

MemoryDojo results by memory system

MemoryDojo has 155 multi-session trajectories built from AgentDojo task templates across workspace, travel, banking and Slack domains. OpenAI's GPT-5.6 Luna served as the agent in the main tests. The table covers the 93 same-domain trajectories.

Storage was rarely the barrier. Unoptimized poison was written to memory in about 98% to 99% of runs on four systems, and 60.75% on Mem0, which uses an LLM to extract facts from a session. Retrieval separated the field: poison surfaced in more than 80% of later tasks on A-MEM and Memora but 33.43% on Graphiti.

Retrieval did not guarantee harm. On four systems, only about one in four retrievals led the agent to carry out the attacker's goal. Optimization narrowed that gap, lifting Letta's rate from 23.59% to 64.06%.

Where the attack weakened

When memory was first filled with about 50 sessions of harmless conversation, retrieval fell on every system. Letta had no later-task reach at all in that test; its retrieval rate dropped from 55.66% to 7.94%.

Context: memory poisoning outside the lab

The threat is no longer theoretical. Microsoft's Defender team said on Feb. 10 it had found more than 50 unique prompts from 31 companies across 14 industries that tried to plant lasting recommendations through "Summarize with AI" buttons. Palo Alto Networks' Unit 42 showed in October 2025 that a malicious webpage could poison an Amazon Bedrock Agent's long-term memory; Amazon said its Guardrails feature provides effective protection.

Anthropic last week detailed how Claude agents revise their own notes through "dreaming".

What's next

The benchmark ran in sandboxed task suites with synthetic trajectories, so its rates are not estimates of real-world compromise. The authors have not yet published the code, saying it will be released, and they list systematic testing of memory defenses as future work. They argue memory architecture "should be treated as a central component of agent security evaluation."

FAQ

What is AI agent memory poisoning?

It is an attack in which untrusted content, such as a document or message an agent reads, gets stored in the agent's long-term memory and then influences later sessions.

How can developers reduce the risk?

MemoryDojo did not test defenses. Unit 42 advises treating all untrusted input as potentially adversarial and layering content filtering, access control, logging and continuous monitoring.

References

• MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory — arXiv (Nov. 6, 2026)
• Manipulating AI memory for profit: The rise of AI Recommendation Poisoning — Microsoft Security Blog (Feb. 10, 2026)
• When AI Remembers Too Much – Persistent Behaviors in Agents' Memory — Palo Alto Networks Unit 42 (Oct. 9, 2025)