Stored Prompt Injection in Agentic Memory Systems

Prompt injection used to be a session problem: feed an LLM agent adversarial text, watch it act on that text, and once the session closes, the damage stays contained. Persistent memory breaks that math. Once an agent can write to a memory store that survives across sessions, a single injected instruction can sit dormant for weeks and then fire against a target the attacker never touched. Treating this as a variant of ordinary prompt injection, rather than a distinct class of vulnerability, is the mistake most teams are still making.

What stored prompt injection means, and why session-bound injection is the wrong mental model

Conventional prompt injection has a built-in expiration date. Adversarial content enters a context window, the model gets tricked into acting on it, and when the session ends, so does the exploit. Every threat model built around this assumption treats the session boundary as a firewall.

That firewall stops existing once agents get writable memory. Researchers Xie, Liu, Zhang, and colleagues have given this failure mode a name: Cross-Session Stored Prompt Injection, or XSPI. It breaks the old assumption two ways at once. Temporally, the adversarial influence outlives the interaction that planted it, sitting quiet until some later session calls it up. Spatially, the instructions don't stay in the prompt where they landed. They move into persistent system state first, then get pulled back into execution whenever that state is read again.

The nearest cousin in web security is stored cross-site scripting. A malicious script gets written into a database or a comment field, and it only runs when some other user later loads that page. Nobody has to trick that second user directly; the trap was already set. Taint propagation analysis offers a second lens: content from an untrusted source travels through a system, unremarkable until it reaches a sink where it actually matters, at which point it becomes a security event. Stored prompt injection borrows both ideas and applies them to a fairly new kind of substrate, the memory files and vector stores that agentic systems now depend on to function across long-running tasks.

The three properties that make persistent memory a different security substrate: persistence, statefulness, propagation

Three properties turn memory into something categorically different from a context window, and each one surfaces in the growing body of research on long-term memory security in LLM agents.

Persistence means a single poisoned entry can be recalled across an unbounded number of future sessions. The attacker doesn't need to come back. The entry just sits there, waiting for its retrieval condition to fire again, and again, indefinitely.

Statefulness changes what the unit of analysis even is. Instead of judging one input at a time, defenders have to reckon with an agent's entire memory as it evolves. An agent that accumulates episodic memories with a subtle bias baked in can drift in its behavior long before any single stored entry looks bad enough to trip a safety classifier. The corruption builds up slowly, so scanning individual entries for red flags misses the slide.

Propagation turns a single poisoned entry into an outbreak. In multi-agent systems, or any setup where agents share memory stores or pass messages to each other, contamination doesn't stay put. It moves through shared context, through tool arguments, through inter-agent messages, crossing boundaries between sessions, between user accounts, even between different agent roles.

Existing defenses were not built for any of this. Prompt-injection filters and RAG-corruption checks operate inside a single session or a single retrieval episode; they check what's in front of them right now, nothing more. Making context windows bigger doesn't touch the problem either. A bigger window improves recall within a session, but it still resets when the session ends, so it does nothing about content that's supposed to outlive the session by design. Once a poisoned memory entry gets written, it needs no further help from the attacker: it's self-sustaining. Concepts like provenance tagging, retrieval scoped to a specific principal, rollbackable memory state, and verified forgetting have started appearing in the research for exactly this reason. None of those ideas mean anything in a stateless system. They only become necessary once content can outlive a session or cross from one user's context into another's.

The attack classes researchers have documented

Documented attacks differ along a few axes: how the payload gets in, what triggers it, which memory backend it targets, and whether it fires right away or waits.

MINJA (Memory Injection Attacks on LLM Agents via Query-Only Interaction), from a team at Michigan State, the University of Georgia, and Singapore Management University, needs nothing more than ordinary user queries to work; no system access required (NeurIPS 2025, arXiv:2503.03704). The mechanism relies on an "indication prompt" that nudges the agent into generating bridging reasoning steps on its own, and a progressive shortening strategy that strips that indication prompt away over successive turns, so the poisoned reasoning trace ends up looking like something the agent came up with naturally. It gets stored, and later users retrieve it as a few-shot example. The reported injection success rate is around 98%, and the barrier to entry is about as low as it gets: any user of a shared agent can poison its memory just by talking to it.

Trojan Hippo runs in two stages. Stage one plants a payload that does nothing yet, delivered through a single untrusted tool call, a crafted email being the example used in testing. Stage two waits until the user brings up something sensitive, finance, health, identity, and only then does the payload activate and start exfiltrating personal data. The researchers ran this against an email assistant across four different memory backends: explicit tool memory, agentic memory, RAG, and sliding-window context. Attack success rates against frontier models from OpenAI and Google ranged from 85% up to 100%, and planted memories still activated even after 100 benign sessions had passed in between. Four memory-system defenses did bring that down, in some cases to as low as 0-5%, but the utility cost of those defenses varied a lot. Deploying them effectively in production stays an open problem, not a solved one.

AgentPoison (arXiv:2407.12784, NeurIPS 2024) goes after RAG knowledge bases specifically. It uses a trigger token engineered to cluster poisoned entries together in embedding space, tested against autonomous driving agents, knowledge-intensive QA systems, and healthcare agents, with an end-to-end attack success rate of 62.6%. This one operates at the level of vector math, not readable text. Because the exploit operates at the level of embedding space rather than readable text, it does not surface through ordinary document review.

The attack surface

OWASP's ASI06 category names this attack class directly: adversarial content written into RAG stores, vector databases, conversation history, or shared context, so that an agent acts on it in some future session rather than the one where it was planted.

Several backends are in scope, and each fails differently. File-based memory, the CLAUDE.md, AGENTS.md, and SOUL.md files that Claude Code, Codex, and OpenClaw load at session start, is human-readable in principle, but it's the agent itself that edits these files day to day. Nobody's necessarily reading the diff. RAG and vector databases can be poisoned to high success rates with just a handful of carefully crafted documents sitting among millions of legitimate ones, and because the exploit lives in embedding space, it stays invisible to anyone reviewing the stored text. Agentic memory systems like Mem0 run asynchronous consolidation pipelines that ingest new content on their own schedule, often before any defense gets a chance to intercept it. Even sliding-window context, which persists for a shorter stretch than the others, still crosses session boundaries in agents built to run long tasks.

The asymmetry here favors the attacker at every step, as a recent survey by Lin et al. lays out. Poisoning a knowledge base takes only a few crafted documents hidden among millions. Exploiting the vector space stays mathematically opaque to anyone reviewing it by hand. And once memory-based persistence takes hold, the attacker doesn't need to do anything else: the write already happened. From there, a single piece of malicious content can sediment into long-term memory and get recalled across dozens, even hundreds, of future tasks that happen to match its retrieval key. The attacker's cost per session approaches zero, while the defender has to catch every write, forever.

Real-system testing: the "Bad Memory" study on Claude Code and Codex

The "Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems" study tested this against real production tools rather than lab prototypes. Researchers built a sandboxed synthetic workspace and ran attacks against two agentic systems, Anthropic's Claude Code and OpenAI's Codex, spread across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5.

Three adversarial goals were tested: stealing credentials, getting the agent to use tools it shouldn't, and targeting specific brands. The payloads were planted in the files these systems load automatically at session start, CLAUDE.md and AGENTS.md, along with additional files the agent may read during its session. This is the exact mechanism named earlier: memory that loads before the user even says anything, updatable by the agent without a human checking the diff first.

Scale as a systemic risk

None of this stays theoretical once adoption numbers get involved. ChatGPT alone reached 900 million weekly active users as of early 2026, and globally, 52% of consumers say they're comfortable relying on personal AI assistants for everyday tasks. That's a mainstream user base handing over real tasks to systems that increasingly carry memory across sessions by default, and the trend line only points toward more of it, not less.

Some of that use runs more sensitive than the rest. Among LLM users who report having a mental health condition, 49% say they use these tools for therapeutic support. For that group, a fabricated persistent memory about their condition, their triggers, or their stated preferences isn't a minor bug: it's a direct path to harm, sitting in a memory file that reloads every single session going forward.

Put the pieces together: high adoption, intimate use cases, and memory that persists, and one successful poisoning event can shape an agent's behavior across months of real interaction with a real person. Academic studies as of 2026 report attack success rates ranging from 80% up to over 99% against actual LLM-based agent implementations, and those aren't lab curiosities. They're numbers pulled from systems that resemble what's shipping in production today.

Regulatory frameworks catching up: OWASP ASI06 and cross-framework mappings

OWASP responded by adding ASI06, "Memory and Context Poisoning," to its 2026 Agentic AI Top 10, and treating it as distinct from LLM01, ordinary prompt injection, is the right call. The distinction isn't cosmetic. ASI06 attacks persist across sessions and can execute days or weeks after the original write; LLM01 resets the moment the session ends. Standard prompt injection filters, tuned for that session-bound threat, simply don't catch what ASI06 describes. This needs its own control category.

For practitioners mapping this against other frameworks, one widely used risk management framework offers two relevant touchpoints: a mapping component covering risks and benefits including those introduced by third-party components, and two measurement components covering security, resilience, and privacy respectively. Together, these give teams a vocabulary for treating persistent agent memory as its own risk category, separate from the prompt-level defenses that already exist and were never built to handle it.