Nothing Crashed. Nothing Flagged. Your Agent Was Already Compromised.

[01] everyone talks about prompt injection

I've built a few AI agents.

Not toy demos. Real ones with memory, tools, API calls, voice, the whole thing.

And like every engineer who's touched LLMs, I learned about prompt injection early.

You've probably seen the examples. Hide instructions inside a PDF. Your agent reads it. Gets tricked into doing something it shouldn't. Session ends. Problem disappears.

So you add guardrails. Sanitize inputs. Write careful system prompts. Add a few filters.

I thought that covered it.

I was wrong.

[02] the thing nobody told me about

A few weeks ago I came across research on something called memory poisoning.

Read the abstract. Skimmed it. Went back and read it properly.

Then sat with it for a while.

Because the numbers alone were enough to make me uncomfortable.

One attack — MINJA (Memory Injection Attack) — needed no special access. Just normal conversations with the agent. That was enough to slip malicious records into memory with 95% success. Those records then steered future answers 75% of the time.

A 2026 follow-up went further. Planted memories that sat completely dormant until a trigger activated them.

No crash. No flag. No obvious sign anything happened.

This is a completely different class of attack, and honestly, it changes how I think about every agent I've ever built.

[03] the chatgpt spy story

In 2024, a security researcher named Johann Rehberger showed something wild.

He got ChatGPT to spy on a user.

Not for one conversation. Across future chats.

He didn't log into their account. No malware. No phishing link. No server breach.

The user just opened a webpage.

That attack is called SpAIware.

And the reason it worked wasn't just clever injection. It was because ChatGPT had long-term memory and that memory got written to.

[04] why this is different

Here's how I now think about the difference.

And that's a completely different problem.

[05]agents don't forget anymore

This matters more now than it did two years ago.

Because modern AI agents have persistent memory.

Vector databases. Long-term memory stores. Preference tracking. That's the whole point, so your assistant remembers who you are instead of making you repeat yourself every single conversation.

But that memory is also a new attack surface.

Instead of manipulating a prompt, an attacker manipulates a memory.

[06] imagine someone rewriting your memories

Your assistant stores something like:

Formal. Fine.

Now imagine it silently stores:

You never see it happen. Nothing crashes. No obvious errors.

Days later your assistant starts making decisions that feel slightly off.

And here's the worst part: the model isn't following a malicious prompt anymore.

It's following what it believes is its own memory.

[07]this isn't one researcher's demo

I thought this might be an isolated edge case.

It's not.

• MINJA showed attackers can inject malicious memories through normal conversations with no special access required. [arXiv:2605.15338v2 ]
• Sleeper Memory Poisoning plants a memory that stays dormant until a future trigger activates it. [arXiv:2407.12784 ]
• AgentPoison uses carefully crafted phrases to activate hidden behaviors only under specific conditions.

None of these require breaking into servers.

They all target the same thing: the memory layer.

[08] when OWASP adds a new category

Here's what made me take this seriously beyond the papers.

OWASP — the organization whose security guidelines thousands of companies actually follow — added memory poisoning as its own standalone category in their top 10 for Agentic AI applications.

They didn't group it with prompt injection.

They separated them deliberately.

That means the industry now recognizes these as two different problems requiring two different defenses.

That's not academic anymore.

[09] the easiest thing you can do today

One recommendation stuck with me immediately.

Go check what your AI assistant remembers about you.

ChatGPT lets you see and delete stored memories. Most assistants do.

Go look.

If you see something you never asked it to remember, delete it. Immediately.

It's the simplest defense available to regular users right now. And almost nobody does it.

[10] where i think this is going

I don't think memory poisoning is a reason to stop building with long-term memory.

Long-term memory is exactly what makes agents go from annoying to actually useful.

But we're in the early days of understanding how to secure it.

It reminds me of where web security was 20 years ago, when developers were just figuring out Cross-Site Scripting. Looked esoteric then. Standard practice now.

Memory poisoning is going to be the same.

We finally know what the attack looks like. Now we have to build the seatbelts.

[11]why i'm writing this

I'm an AI Engineer, building AI agents and shipping in public.

I wrote this because when I was deep in building Agentic AI and while designing the memory layer, the RAG pipelines, the recall system — nobody warned me this attack class existed.

If you're building anything with persistent agent memory, go read about this.

Not to be scared. To be prepared.

The builders who understand the attack surface are the ones who'll build the systems worth trusting.

And right now, that's a pretty short list.