Beyond Prompt Injection – Detecting Persistent Memory Poisoning in AI Agents
As AI assistants move from single-turn chatbots to agents with persistent memory, that memory becomes a new attack surface. This talk examines persistent memory poisoning: an attack class where malicious instructions embedded in web pages, documents, or support tickets get extracted and stored as trusted long-term memory, then surface weeks later to influence unrelated decisions.
Unlike a standard prompt injection that dies with the session, a poisoned memory item persists across sessions and can quietly redirect an agent’s behavior, for example, convincing it to recommend a fake vendor or a fake security contact as “official.”
We walk through a concrete attack: an enterprise browser-enabled agent visits an SEO-optimized attacker page containing hidden text instructing it to “remember” a fake support provider. The agent stores this as fact, and a month later recommends the attacker-controlled contact when a real user asks for help. No exploit, no malware, just poisoned trust.
We then present a memory risk-scoring framework that treats every extracted memory as untrusted until scored against five signals: source reputation, persistent-request phrasing (“remember this,” “from now on”), unverified external contact information, contradiction with existing memory, and sensitive-category modification (payment, VPN, vendor, security contacts). High-risk memories are quarantined or held for user confirmation instead of silently committed to long-term storage.
A working Python proof of concept demonstrates the difference: a vulnerable agent that blindly trusts extracted memory versus a defended agent that scores it first. We close with directions for hardening this further, including LLM-based semantic classification of borderline cases, trust-graph modeling across memory sources, and retrieval-time revalidation rather than one-time checks at storage time.
What Attendees Will Take Away
This session walks attendees through the full arc of the problem and its defense: why memory poisoning outlives a simple prompt injection by persisting across sessions, what attackers try to get an agent to remember (fake vendors, support contacts, and security rules), and how poisoned content enters through web pages, documents, tickets, email footers, and hidden text in files. It then goes inside a practical memory risk engine and the five signals it checks before trusting a memory item: source reputation, persistent-request phrasing, unverified external contacts, contradiction detection, and sensitive-category modification. It closes with where this detection model can go next, including semantic classification, trust-graph analysis, and retrieval-time revalidation.
Jyotika A Singh – Forcepoint
Jyotika serves as a Security Researcher II on the X-Labs Threat Research Team. She specializes in web security, malware analysis, and emerging cyber threats, with a focus on identifying and mitigating evolving attack techniques. Her work aims to enhance proactive defense strategies and contribute to advancing cybersecurity knowledge.
Prashant Kumar – Forcepoint
Prashant Kumar is a Senior Security Researcher with 8+ years of experience in cybersecurity, specializing in the research and analysis of malicious URLs, emails, and files. His work focuses on identifying and mitigating emerging and in-the-wild cyber threats, including sophisticated phishing, social engineering and malicious campaigns.
He also researches AI-assisted phishing and AI-driven malicious campaigns, exploring how threat actors are leveraging AI to evolve their attack techniques and how security teams can detect and defend against them.
Beyond threat research, Prashant actively shares his findings and technical insights through research blogs published on the Forcepoint website. He is also a conference speaker and recently presented his research at CSA XCON 2026.