Agent memory carries poisoned content past the defense

A file your agent read last month is still working on you. Not the file itself. A note the agent made while reading it, saved as a memory and pulled back up today as if it were something the agent had always known. If that file was poisoned, the instruction buried in it just woke up. And the defense you trusted to stop exactly this never fired, because it was never looking here.

Start with what that defense is, since most people missed the week it got named. Prompt injection is the attack where someone hides commands inside content an AI reads, a webpage, a shared document, the output of a tool, so the agent obeys the buried instruction instead of you. The fix the field converged on is a wall. You split the agent in two. One half reads the risky content but has no power to act. The other half can act but never reads the risky content directly, it only gets a clean summary. An injected command lands in the half with no hands. This is the dual-LLM pattern, and it’s widely cited as the only structural defense we have. A layered version, the CASCADE architecture (arXiv 2604.17125), cut attack success from 73% to under 9% in testing [verified]. At the border, the wall holds.

Then agents got memory, because one that forgets you every session isn’t worth much. Now it keeps notes across conversations and treats those notes as its own. That’s the crack. In 2026 a run of security papers traced what happens when poisoned content arrives, gets filed as a memory, and comes back later. One study of stateful assistants, “Hidden in Memory” (arXiv 2605.15338), found poisoned memories were accepted 99.8% of the time on GPT-5.5 and 95% on Kimi-K2.6. When those memories were later retrieved, they drove the attacker’s intended action in 60 to 89% of cases [reported].

The wall guards a border in space. Memory carries the attack across time. An agent that remembers has no fixed inside left to defend.

Walk the attack against the wall and you see why the wall can’t help. When the poisoned document first arrives, the defense works perfectly. It’s external content, the reading half handles it, the acting half never touches it. No breach. Then the agent stores something from that read as a memory, which is the feature working as intended. Later, in a different conversation, it retrieves that memory. Now the wall is silent, because memory is the inside. Retrieval returns the agent’s own state by definition, so the layer that stitches together system instructions and recalled notes can’t tell the two apart. The content that was external on Monday is internal by Friday. It never crossed the wall. It aged across the boundary from the trusted side.

There’s a sharper version at the compression step, where an agent squeezes long context down to fit a budget. Attacks aimed at the compression itself, called COMA (arXiv 2510.22963), succeeded about 71% of the time, against 21% for ordinary injection [reported]. The squeezing happens after retrieval, on content the agent already counts as its own. There’s no border there to build a wall on.

The honest objection is that this is just a second boundary. Found a new seam, build a new wall: a second read-and-act split at the point of memory retrieval. Two boundaries, two defenses, no contradiction. The researchers who documented the attack wrote it up calmly and prescribed three fixes: track where each memory came from, watch for content that surfaces long after it entered, and treat the compression step as untrusted.

Look at those fixes, though. Not one of them is a wall. Tracking a memory’s origin means tagging every stored item with its source and carrying that tag for as long as the item lives. Watching for late-surfacing content is surveillance across time, not across a seam. And treating compression as untrusted means the agent has to distrust its own internal step. Every one of them answers a question a wall never has to ask: how long ago was this trusted, and by whom? That’s a clock. A wall has no clock. It classifies content once, at the door, and it’s done. You can’t bolt a clock onto a wall. You replace the wall with a lifecycle, which is what those fixes quietly are. Trust becomes a property of every stored item, re-checked over the whole life of that item.

This isn’t one team’s tuning problem. The memory that springs the trap is the same memory you were told to build first. The convergent advice for running agents at scale is to persist their state, the common pattern across platforms like Letta and Augment Code being a Redis and PostgreSQL store, because agents can’t scale without externalizing what they know. So two solid pieces of advice sit in the same playbook: build the wall to stop injection, and build the persistent memory to scale. The second dissolves the first. The more state you store to grow, the more content you give time to age from untrusted into trusted, and the less the wall covers. A stateless agent can be defended by a wall. The kind you can actually scale carries content across its own trust boundary as its core job, because that is what memory is.

The rulebooks don’t catch this yet, and it’s worth knowing why before you lean on them. The EU AI Act’s high-risk obligations took effect in August 2026 [verified], and along with the NIST AI Risk Management Framework they require injection controls at the model, application, and context layers. Every one of those controls is spatial: which layer, which boundary. None of them asks whether trust decays over time. The frameworks were written for stateless agents and outside attackers. Ship a memory-bearing agent, pass the audit, and you’ve certified the wall while saying nothing about the clock.

Carry one question into your next design review: does “keep the untrusted content away from the part that acts” still mean anything once your agent remembers? The same note is untrusted when it arrives and trusted when it’s recalled. The same memory layer is your path to scale in one document and your injection vector in another. If someone ships memory that stays checked for origin on the way back out, at real production speed, then the wall keeps its title, scoped honestly to the agents that don’t remember. Until then, before you turn memory on, find out whether your defense can tell time. Most of them only know how to guard a door.