Memory poisoning

The definition

Corrupting an agent's persistent memory so that later sessions act on attacker-chosen content. Named ASI06, Memory & Context Poisoning, in the OWASP Top 10 for Agentic Applications 2026. The 2026 research locates its root at the write path: stored entries lose where they came from, so a web page or tool result is later recalled as trusted knowledge.

The same words the glossary hub and the public data mirror carry; this page is the stable address for the term.

Related terms

• Agent

  Software that uses tools to carry out tasks and workflows — not just replying, but acting: calling APIs, running steps, making changes. Distinct from a…

• Memory

  The store of facts, preferences, and records a system keeps so it doesn’t start from nothing each time. What is stored — distinct from which stored facts are…

• Context

  The working information a system has in view right now, for this specific request. What is relevant this call — narrower than persistent context, and…

• Knowledge

  What a system currently takes to be true: facts with a validity and a source, as distinct from the records they came from. A memory is a record of what was…

Where it shows up on this site

• What is a continuity layer · ReferenceThe definition, in full
• The primer: memory is not continuity · ReferenceSix distinctions, seven contrasts, the five obligations in brief