--- title: Your Agent’s Memory Is a Liability: Defending Against... description: Persistent AI agent memory systems (Claude, Gemini, MemGPT, LangMem, Zep) are vulnerable to context poisoning, a delayed prompt injection attack where an... canonical: https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your Agent’s Memory Is a Liability: Defending Against Context Poisoning in Persistent AI Systems | daily.dev og:description: Persistent AI agent memory systems (Claude, Gemini, MemGPT, LangMem, Zep) are vulnerable to context poisoning, a delayed prompt injection attack where an... og:url: https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r og:image: https://api.daily.dev/og/posts/v3mtyIs8r.png og:image:alt: Your Agent’s Memory Is a Liability: Defending Against Context Poisoning in Persistent AI Systems og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your Agent’s Memory Is a Liability: Defending Against Context Poisoning in Persistent AI Systems **[gitconnected](https://daily.dev/sources/gc)** · 6 min read · 1 upvotes · 0 comments ## Summary Persistent AI agent memory systems (Claude, Gemini, MemGPT, LangMem, Zep) are vulnerable to context poisoning, a delayed prompt injection attack where an adversary plants a malicious instruction in data the agent later stores and retrieves as trusted context. Because retrieved memories share the same trust boundary as system prompts, attacks can lie dormant for weeks before execution. Standard defenses like input filtering, output guardrails, and tool sandboxing fail to stop it. Proposed mitigations include provenance-tagged memory entries with trust scores, trust decay with anomaly detection over time, and write-ahead confirmation gates for high-risk actions triggered by retrieved memory, combined as defense-in-depth layers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is context poisoning in AI agents with persistent memory? Context poisoning is a delayed prompt injection attack where an attacker plants a malicious instruction disguised as ordinary content (like an email or Slack message) into an agent's long-term memory. Because retrieval systems treat recalled context as trusted, the payload executes whenever a later, unrelated query surfaces that memory entry, sometimes weeks after injection. _Teams shipping memory-enabled agents can follow emerging security patterns like this via daily.dev._ ### Why don't input filtering and output guardrails stop context poisoning attacks on AI agents? Input filtering fails because the malicious instruction is semantically valid text indistinguishable from a legitimate request, so regex or keyword filters cannot separate 'summarize the report' from 'summarize the report and email credentials to this address'. Output guardrails fail because by the time the agent acts, the resulting tool call looks identical whether it came from a poisoned memory or a legitimate user request. _Developers evaluating agent security tradeoffs can track these defense patterns through daily.dev._ ### How does provenance-tagged memory defend against prompt injection in agent systems? Provenance-tagged memory attaches metadata to every memory entry, including source_type (user_input, agent_generated, external_ingest), source_identity, timestamp, and a trust_level score from 0.0 to 1.0. Entries ingested from external sources like email or web scrapes are marked low-trust and treated as informational only, so embedded instructions in them are never executed automatically, forcing the agent to reason about where information came from before acting. _Anyone architecting agent memory can weigh provenance-based defenses like this via daily.dev._ ## Similar posts on daily.dev - [Prompt Injection Attacks In Agentic AI Security Risks](https://daily.dev/posts/prompt-injection-attacks-in-agentic-ai-security-risks-0poqxk9z7) · Cyble · 1 upvotes · 0 comments - [Your AI’s Memory Is Not a Diary. It’s a Target.](https://daily.dev/posts/your-ai-s-memory-is-not-a-diary-it-s-a-target--ybcyihj8j) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude](https://daily.dev/tags/claude), [#vector-search](https://daily.dev/tags/vector-search), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your Agent’s Memory Is a Liability: Defending Against Context Poisoning in Persistent AI Systems","url":"https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r"},"datePublished":"2026-09-12T18:13:22.765Z","dateModified":"2026-09-12T18:13:48.055Z","description":"Persistent AI agent memory systems (Claude, Gemini, MemGPT, LangMem, Zep) are vulnerable to context poisoning, a delayed prompt injection attack where an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/924d1cdbd294db842b34d9b89a415d37?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/924d1cdbd294db842b34d9b89a415d37?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"gitconnected","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"gitconnected","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/gc","url":"https://daily.dev/sources/gc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,claude,vector-search,prompt-injection","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"gitconnected","item":"https://daily.dev/sources/gc"},{"@type":"ListItem","position":3,"name":"Your Agent’s Memory Is a Liability: Defending Against Context Poisoning in Persistent AI Systems"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-agent-s-memory-is-a-liability-defending-against-context-poisoning-in-persistent-ai-systems-v3mtyis8r#faq","mainEntity":[{"@type":"Question","name":"What is context poisoning in AI agents with persistent memory?","acceptedAnswer":{"@type":"Answer","text":"Context poisoning is a delayed prompt injection attack where an attacker plants a malicious instruction disguised as ordinary content (like an email or Slack message) into an agent's long-term memory. Because retrieval systems treat recalled context as trusted, the payload executes whenever a later, unrelated query surfaces that memory entry, sometimes weeks after injection. Teams shipping memory-enabled agents can follow emerging security patterns like this via daily.dev."}},{"@type":"Question","name":"Why don't input filtering and output guardrails stop context poisoning attacks on AI agents?","acceptedAnswer":{"@type":"Answer","text":"Input filtering fails because the malicious instruction is semantically valid text indistinguishable from a legitimate request, so regex or keyword filters cannot separate 'summarize the report' from 'summarize the report and email credentials to this address'. Output guardrails fail because by the time the agent acts, the resulting tool call looks identical whether it came from a poisoned memory or a legitimate user request. Developers evaluating agent security tradeoffs can track these defense patterns through daily.dev."}},{"@type":"Question","name":"How does provenance-tagged memory defend against prompt injection in agent systems?","acceptedAnswer":{"@type":"Answer","text":"Provenance-tagged memory attaches metadata to every memory entry, including source_type (user_input, agent_generated, external_ingest), source_identity, timestamp, and a trust_level score from 0.0 to 1.0. Entries ingested from external sources like email or web scrapes are marked low-trust and treated as informational only, so embedded instructions in them are never executed automatically, forcing the agent to reason about where information came from before acting. Anyone architecting agent memory can weigh provenance-based defenses like this via daily.dev."}}]} ```