Security · 24 Aug 2026 · Rob Nidschelm

One Prompt Poisoned the Agent’s Memory for Later Questions.

An attacker may not need access to an AI agent’s memory database to poison it. Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated a single-interaction attack that plants a crafted record through the agent’s normal conversation interface, then steers later answers when related topics cause that record to be retrieved.

The research, called InjecMEM, was published on arXiv on 24 August 2026 and accepted at COLM 2026. It turns a feature designed for continuity into a delayed instruction channel: data enters memory as conversation, persists after the original interaction and later returns inside the model’s prompt as executable context.

One interaction, two cooperating components

InjecMEM combines a retriever-agnostic anchor with an adversarial command.

• The anchor contains high-recall cues for a chosen topic. Its job is to make the memory system associate the poisoned record with later questions in that domain.
• The command is a short sequence optimised to steer the model toward an attacker-selected output after the record is retrieved.

The distinction solves two separate problems. A malicious instruction is useless if the memory system does not retrieve it. A highly retrievable record is harmless if it cannot influence generation. InjecMEM is designed to make both stages succeed.

The researchers assume that the agent logs interactions and retrieves memories according to the topic of a later query. The attacker submits one prompt or routes an equivalent prompt through a compromised tool. The attacker does not read or edit the memory store and does not need to know its embedder, keyword model or summary model.

Why ordinary prompt injection was not enough

Agent memory is dynamic. New interactions accumulate, records move through short-, mid- and long-term stores, and retrieval fuses multiple items into a long prompt. The poisoned record may appear at different depths and beside different context every time. The influence of a conventional fixed-position injection can therefore collapse as memory drifts.

The researchers created Multi-GCG, a gradient-based coordinate-search method that optimises one command across synthetic contexts of different lengths and at different insertion positions. That training makes the command less dependent on where the retrieved memory appears in the final prompt.

Measured against MemoryOS and MemGPT

The paper evaluated the attack primarily on MemoryOS and then reused it against MemGPT. The authors report three distinct metrics: whether the poisoned record was retrieved, whether it controlled generation once retrieved, and whether both happened end to end.

• MemoryOS: 46.5% retrieval success, 76.6% generation success conditional on retrieval and 35.6% joint end-to-end success.
• MemGPT: 37.2% retrieval success, 48.6% conditional generation success and 18.1% joint success.

The 76.6% figure is therefore not the probability that one prompt compromises every agent interaction. It is the attack success rate after the poisoned record has already been retrieved. The more operational end-to-end measurement on MemoryOS was 35.6% in the authors’ setup.

Retrieval weakened as benign topic-specific memories accumulated, but the poisoned record continued to surface under memory drift. Queries outside the target topic were largely unaffected, which makes the behaviour less obvious than a global degradation.

Transfer is real, but not universal

The strongest generation attacks used white-box access to a backbone model. A command optimised only for Qwen2.5-7B transferred poorly to some differently sized Qwen variants, although it remained effective against a fine-tuned 7B model. Joint optimisation across Qwen2.5-1.5B and 7B improved results on unseen 3B and 14B variants.

Cross-family transfer was harder. A command jointly optimised for Qwen and Mistral failed against the held-out Llama model. The authors nevertheless achieved non-trivial coverage across all three by concatenating separately optimised commands. That makes the research relevant to deployments built on known open-weight model families, but it does not establish a universal black-box payload.

Common filters did not close the boundary

The team placed LLM-as-a-Judge, ProtectAI and PromptGuard filters between memory retrieval and prompt fusion. At the tested default threshold, each reduced poison retrieval but left conditional attack success near 75% to 77%. A perplexity filter stopped retrieval completely only while blocking 71.8% of benign pages in the authors’ test.

This is a security-utility problem. A filter can suppress the attack by rejecting most memory, but that also destroys the capability the memory system was added to provide.

The boundary defenders need to build

• Treat stored conversation and tool output as untrusted data, even after it has been summarised or promoted into long-term memory.
• Record memory provenance, the actor or tool that supplied it, and the reason it was retained.
• Separate user preferences and factual notes from executable instructions. Retrieval should not silently promote remembered text to system-level authority.
• Require review or stronger corroboration before a single interaction becomes durable memory for sensitive domains.
• Expose memory inspection, deletion and audit controls so a poisoned record can be found and removed.
• Evaluate attacks across the complete write, retrieve and generate pipeline. Testing the model or retriever in isolation misses the compound failure.

What the paper does not prove

The experiments were conducted mainly in controlled environments with synthetic data and non-operational target outputs. The authors do not report exploitation of a commercial production agent. InjecMEM is most directly applicable to systems that store original interaction text so the adversarial string can reappear at retrieval time. Memory pipelines that aggressively rewrite or transform records may require a different attack.

Those limits do not erase the boundary failure. They define it. A normal interaction can become a persistent instruction without database access, and later users can trigger it without seeing the original poison. For agent builders, memory is no longer just a convenience layer. It is stored, executable context with a security lifecycle of its own.

Sources

• Tian et al., “InjecMEM: Memory Injection Attack on LLM Agent Memory Systems”, submitted to arXiv on 24 August 2026 at 16:37:50 UTC, or 18:37:50 Europe/Madrid. The paper is listed as accepted at COLM 2026.
• Full 29-page InjecMEM paper, arXiv version 1, 24 August 2026.
• InjecMEM research code repository, linked by the paper.