Your Guardrails Check Every Request. Memory Poisoning Isn't in the Request.
Nearly every agent security control in production today shares one quiet assumption: the threat arrives with the request. Scan the prompt, scan the tool call, scan the output, and the session ends clean. Tomorrow starts fresh.
Persistent memory broke that assumption, and most stacks haven't noticed yet.
Agents now remember. They store user preferences, task outcomes, retrieved documents, and "lessons learned" in long-term memory that survives the session — that's the whole point of the feature. Which means an attacker no longer needs to win during the request. They need to win once, in a way that gets written down. After that, your agent carries the payload for them, session after session, long after the attacker has logged off.
The attack that's still there tomorrow
The research on this is no longer speculative.
The MINJA memory injection attack showed that an attacker with nothing but ordinary query access — no infrastructure compromise, no direct write access to the memory store — can plant malicious records in an agent's memory that later victims retrieve. Across a healthcare records agent, a web-shopping agent, and a QA agent built on GPT-4 and GPT-4o, MINJA achieved an average injection success rate of 98.2% and an average downstream attack success rate of 76.8%. On the GPT-4o shopping agent, injection succeeded 99.3% of the time. The mechanism is elegant and ugly: bridge the victim's normal queries to malicious reasoning steps, then let the agent's own memory retrieval do the rest.
A June 2026 systematic study, "From Untrusted Input to Trusted Memory", ran 3,240 memory-poisoning test cases across two agent frameworks and confirmed the property that makes this class of attack different: persistence. A malicious instruction written in one session influenced agent behavior in later sessions with no further attacker involvement. Worse, when the researchers pointed existing prompt-injection defenses at these attacks, the best of them caught only 42.5% of weak-signal variants — the ones written to look like ordinary memories. Detection rates across all tested defenses dropped as low as 10% once the payload stopped looking like an attack.
OWASP has already filed this under its own heading. The OWASP Top 10 for Agentic Applications lists Memory & Context Poisoning as ASI06 — behavior manipulation that, in OWASP's words, persists long after the initial interaction concludes.
Why your per-request controls miss it
Prompt-injection defenses are pattern-matchers on live traffic. They evaluate a request in isolation: is this input trying to manipulate this response? That framing fails against memory poisoning three separate ways.
First, the write looks benign. A poisoned memory entry is designed to read like a routine observation — a preference, a fact, a completed task. The weak-signal detection numbers above are exactly this failure: the payload passes inspection because at write time, it isn't doing anything yet.
Second, the trigger looks benign too. The victim's query that eventually retrieves the poisoned record is a completely legitimate request. There is nothing in it to flag. The malicious content enters the context from inside the trust boundary — from the agent's own memory, which most pipelines treat as trusted by default.
Third, the timeline breaks your forensics. When the bad behavior finally fires, the input that caused it happened days or weeks earlier, in a different session, possibly from a different user. If you can't reconstruct the write history of your agent's memory, you can't answer the only question that matters in the incident review: when did this agent start believing that, and who told it?
Treat memory writes like production deploys
The fix isn't a smarter regex on inbound prompts. It's recognizing that a write to persistent agent memory is a privileged state change — the same category of event as a deploy or a config push — and giving it the same lifecycle: inspection before it lands, an immutable record that it landed, and monitoring for what it changes afterward.
That's three of VeriSwarm's pillars, working the specific shifts they were built for.
Guard inspects the write path, not just the chat path. The same scanning that catches PII and injection patterns in live traffic runs against content headed into memory — so a "memory" that contains an instruction gets caught at write time, when it's cheap to refuse, rather than at retrieval time, when it's already load-bearing. And when something does slip through and an agent starts acting on poisoned state, the kill switch ends its shift immediately — no redeploy required.
Vault gives you the timeline. Every memory write lands in a hash-chained, immutable audit ledger. When behavior drifts, you don't reconstruct events from application logs that an attacker may have influenced; you walk a verifiable chain back to the exact write, the exact session, and the exact source that introduced the poison. The incident-review question — who told it that, and when? — becomes a query, not an archaeology project.
Gate catches what inspection misses. Poisoned memory changes behavior, and behavior is what Gate scores. An agent that starts recommending an odd product, escalating unusual actions, or deviating from its historical baseline takes a trust-score hit even when every individual request looks valid — which is precisely the failure mode the detection studies describe. The score moves before your users notice, and policy tiers decide what a lower-trust agent is still allowed to do while you investigate.
The uncomfortable summary
Session-scoped security for agents with persistent memory is perimeter security for a threat that's already inside. The research says injection succeeds against capable, well-known agent architectures at rates above 95%, persists without attacker effort, and defeats the defenses most teams currently rely on more than half the time.
Your agents remember things. Start keeping receipts on what they're told.
Gate's trust scoring is free and always on. Start scoring your agents at veriswarm.ai — and if your agents have long-term memory, ask us about putting Guard on the write path before someone else does the writing.
Sources: MINJA: Memory Injection Attacks on LLM Agents (arXiv:2503.03704) · From Untrusted Input to Trusted Memory (arXiv:2606.04329) · OWASP Top 10 for Agentic Applications