When AI Agents Remember, Hackers Can Poison Their Memories

Artificial‑intelligence assistants are no longer just one‑off answer machines. The latest breed of AI “agents” can jot down bits of what they learn, pull that information back later, and even use external tools to finish a job. It feels a bit like having a diligent assistant who keeps a running notebook of every request you ever made.

That notebook, however, can be tampered with. In a recent study conducted by researchers at the University of Calgary, we found that a malicious actor can slip a misleading instruction into an agent’s memory – a trick we call memory poisoning. The catch? The poison often doesn’t show its effects straight away. The agent may carry on, seemingly perfectly normal, for a handful of interactions before it finally opens the poisoned page and acts on the falsehood.

Think of it like this: someone writes a line in an employee’s logbook saying, “All requests from John are automatically approved.” The employee reads the note, but only when a request actually comes in from John does the mistake reveal itself. Until then, the employee appears to be doing everything right. The same delayed reaction shows up in AI agents that have persistent memory.

Our experiments simulated 2,614 multi‑step attack trajectories against large‑language‑model agents that could remember. We looked at four flavours of poisoning: chain poisoning, where one bad cue triggers a cascade; policy rewriting, which subtly rewrites the agent’s decision rules; backdoor triggering, a hidden trigger that only fires under certain conditions; and slow drift, a gradual slide into malicious behaviour. Rather than merely checking if an attack succeeded, we watched the agents evolve over time.

The results were eye‑opening. Some attacks blended in so well that a single‑step inspection would label the agent as safe. Only after several rounds did the backdoor or drift become obvious. Moreover, the risk didn’t rise in a neat, straight line. We observed “non‑monotonic” patterns – the agent might look more suspicious at one point, then less so, before finally slipping into the intended misbehaviour.

This has big implications for how we test AI security. A security team that only looks at the moment an agent first encounters a suspicious prompt could be fooled – it’s like checking a notebook right after someone slips in a false entry, before anyone has read it. To truly gauge safety, we need to follow the whole story, watching how the agent behaves across a chain of interactions.

Why does this matter now? Because AI agents are moving beyond short chat sessions. They’re being deployed to schedule meetings, draft reports, even manage inventory – tasks that stretch over minutes, hours, or days. When an agent can also invoke external tools, a poisoned memory could steer it toward the wrong database, the wrong email recipient, or an insecure API.

That’s not to say memory‑enabled agents are unsafe by design. Their ability to retain context, learn preferences, and handle complex workflows is exactly why they’re valuable. The takeaway is that protecting the prompt is no longer enough; we must also safeguard the information the agent carries forward.

In practice, this means shifting from snapshot‑style testing to what we call “trajectory‑aware” security assessments. Instead of judging each prompt in isolation, we evaluate the entire interaction sequence – the full narrative of the agent’s behaviour. If you were to borrow the notebook analogy, you wouldn’t just watch the assistant write a single page; you’d also skim earlier pages and see how they influence later decisions.

As AI agents become more common in workplaces and critical systems, remembering becomes a double‑edged sword. Security teams need a memory of their own, tracking how threats might lurk and emerge over time. Only then can we keep the benefits of AI assistants without handing hackers a convenient place to hide their poison.