State persists across sessions and users
What one interaction writes into memory can influence what every future interaction reads back out.
By risk
When an agent's memory becomes the attack surface.
Long-running agents persist state across sessions and users. Poisoned memory doesn't cause one bad response-it corrupts every future decision that reads it, and traditional input scanning misses attacks that arrive over time.
Why it matters
A compounding threat, not a single bad response
Damage compounds instead of resolving
Unlike a single hijacked response, poisoned memory keeps producing bad decisions until it's found and removed.
Input scanning alone misses it
Attacks that arrive gradually over multiple writes don't look malicious in any single interaction-only in the pattern.
What Lineation does
Treat memory writes like any other privileged action
Memory & context integrity checks
Writes to persistent state are validated against expected schema and source before they're accepted.
Anomaly detection on stored state
Monitoring covers what's stored, not just live input, catching drift from an agent's normal memory baseline.
Policy-scoped memory writes
Least privilege applies to state, not just actions-an agent only writes what its policy explicitly allows.
Replayable write history
Full history lets you trace exactly when corruption entered and what read from it afterward.
How it works
Five steps to trustworthy agent memory
Scope memory access
Define what an agent's memory store may read and write, by policy.
Validate every write
Writes are checked against expected schema and source before acceptance.
Monitor for drift
Stored state is watched for deviation from the agent's normal baseline.
Quarantine suspicious entries
Flagged entries are isolated without wiping the agent's full memory.
Replay to find patient zero
Write history is traceable back to the exact entry that introduced the corruption.
FAQ
Common questions
What is memory poisoning in an AI agent?
Corruption of the persistent state or context a long-running agent relies on, so future decisions are influenced by fabricated or malicious information.
How is this different from prompt injection?
Prompt injection manipulates a single interaction. Memory poisoning corrupts state that persists across sessions, so damage compounds over every future decision.
Can a single malicious document poison long-term memory?
Yes, if ingested content is written directly into memory or a vector store without validation, one document can influence every future retrieval that touches it.
Does quarantining a memory entry break the agent's task?
Quarantine isolates the flagged entry rather than wiping full memory, so the ongoing task continues on validated state.
How does this map to OWASP's ASI06?
OWASP's Top 10 for Agentic Applications names memory and context poisoning as ASI06. Integrity checks, scoped writes, and anomaly detection are the direct runtime mitigations.
Does this apply to vector databases and RAG pipelines?
Yes-RAG poisoning is a specific form of memory poisoning, and the same write-scoping and integrity checks apply to vector store ingestion.
Trust the agent's memory again.
Scope writes, validate state, and replay history the moment something looks wrong.