Category: Cyber Security | Published: 2026-08-27
An AI assistant that remembers your preferences sounds helpful. An AI assistant that quietly remembers something false is a very different proposition.
Researchers have demonstrated how an attacker could plant misleading information into an agent’s long-term memory and then wait for it to influence a later decision. The original webpage, email, or document might be long gone by the time the false fact is used. That makes AI memory a security issue, not just a convenience feature.
The idea is known as persistent memory poisoning. It is an emerging risk for businesses experimenting with agents that browse the web, read company information, use software tools, and carry out tasks without someone checking every step.
What Is Persistent Memory Poisoning?
Researchers at US cyber security company Forcepoint have shown how information controlled by an attacker could be stored by an AI agent and later treated as a trusted fact. The demonstration focuses on a travel assistant, but the same pattern could apply to many business workflows.
Unlike a standard chatbot, an agent with persistent memory can carry useful information between conversations. It might remember a user’s preferences, an ongoing project, a previous decision, a supplier detail, or an instruction about how a particular process works. This makes the assistant feel more capable because it does not have to start from zero every time.
It also creates somewhere for an attacker to leave information behind.
Forcepoint Senior Security Researcher Syed Hassan Faizan described the problem simply: as AI agents store and reuse more long-term information, that memory becomes a new target. The attacker does not necessarily need to take over the model or steal an account. They may only need to persuade the agent to remember a lie.
How the Attack Could Work
Imagine an employee asks an AI travel assistant to research a destination. The agent visits a convincing webpage containing instructions that are not visible to the person reading it but can still be extracted by the browser or AI system.
Among the genuine-looking travel information is a false claim that a particular company is the employee’s official emergency booking provider. If the agent stores that claim without checking the source or asking for confirmation, it becomes part of the assistant’s long-term context.
Nothing dramatic needs to happen immediately. The attacker’s page can disappear and the employee can move on to another task. A month later, the same person asks the assistant what to do after a flight is cancelled. The agent searches its stored information and recommends the attacker-controlled provider as though it were an established contact.
The delayed nature of the attack is what makes it so uncomfortable. The person who receives the unsafe recommendation may have no reason to connect it with an ordinary research task weeks earlier. A routine support interaction could have quietly changed what the assistant believes.
This Is More Than an Ordinary Prompt Injection
Prompt injection is already a recognised problem in generative AI. Malicious instructions can be hidden in a webpage, document, email, or other content that an AI is asked to summarise or process. The instructions attempt to change what the model does during that particular task.
Memory poisoning takes the same broad idea and adds persistence. A prompt injection may stop mattering when a session ends. A poisoned memory can continue influencing separate conversations after the original source is no longer in view.
That difference changes the investigation process. If an agent gives a bad answer today, a security team may inspect the current prompt, recent files, and connected tools. With poisoned AI memory, the cause may be buried in an old interaction that looked harmless at the time. The source may no longer be online, and the memory may have been retrieved without any obvious sign that it was attacker-controlled.
Businesses should therefore ask two separate questions. Can the agent be manipulated by what it is reading right now? And can something it read previously affect what it does later?
Where False Memories Could Come From
An attacker-controlled memory item could enter through many of the places an organisation already wants its AI tools to search. Potential sources include:
- webpages and online directories;
- shared documents and PDFs;
- email and support tickets;
- knowledge bases and internal wikis;
- messages in Teams, Slack, or other collaboration platforms; and
- data returned by connected applications or APIs.
The content does not have to look suspicious to a person. It may be hidden using formatting, inserted into a long document, or mixed in with accurate information. An employee may see a useful summary while the system also receives an instruction telling it what to remember.
The risk is greater when an agent has permission to store information automatically. A design intended to make the assistant more useful can accidentally turn every source it reads into a potential contributor to its beliefs.
Why Business Consequences Could Be Serious
The travel example is easy to understand because the possible outcome is a fake booking provider. In a business environment, the false memory could concern something much more sensitive.
An agent might be persuaded to remember a fraudulent supplier domain, an unauthorised support contact, a fake internal procedure, or an incorrect approval route. It might store a preference that weakens a security control or believe that a particular person is allowed to access information they should not see.
If the agent only provides suggestions, the result may be a bad recommendation that a person catches. If the agent can send messages, update records, call APIs, approve requests, or change settings, the false information can lead directly to an action.
This is why AI memory cannot be treated as a neutral filing cabinet. The agent may use a remembered fact as context for a decision without presenting the entire history behind it. A wrong memory can therefore look like a confident, helpful answer.
The More Autonomous the Agent, the Larger the Risk
AI agents are moving beyond one-off question answering. They can browse websites, search corporate systems, summarise messages, write software, update a CRM, create tickets, and trigger automated workflows. Long-term memory helps them handle these tasks with less repetition.
It also means an incorrect memory can travel further. One false supplier detail could be reused in several conversations. A mistaken security instruction could be applied to more than one system. A wrong customer preference could shape a series of responses before anyone notices the pattern.
This is a different security problem from a stolen password. The agent may still be operating through a valid account and making apparently ordinary tool calls. The weakness is that the context guiding those calls has been contaminated.
How Organisations Can Protect AI Memory
The first step is to decide what an agent is allowed to remember. Not every useful detail needs to become permanent. Organisations should be especially careful with information about payments, suppliers, identity, access rights, security procedures, and approval chains.
One useful approach is memory risk scoring. Before a new item is saved, the system could consider where it came from, whether the source is trusted, whether the item conflicts with existing records, and whether it asks to be remembered permanently. A new domain supplied by an unknown webpage should not receive the same level of trust as a verified entry in a controlled business system.
High-risk items can be rejected, quarantined, or sent to a person for confirmation. Stored memories should retain their source and the time they were created so that an investigator can trace them later. An expiry date or review date can also prevent temporary information from becoming a permanent instruction by accident.
Verification should happen again when a memory is retrieved for an important task. If the agent is about to recommend a supplier, disclose information, change access, or trigger a payment, it should check the remembered detail against an authoritative system rather than relying on its own history.
Permissions matter too. An agent that can read a knowledge base does not necessarily need permission to write to long-term memory. An assistant that can draft a change should not automatically be able to apply it. Keeping memory writes and high-impact actions behind separate controls limits what a poisoned item can do.
Finally, log the memory lifecycle. Security teams should be able to see what was stored, which source supplied it, when it was retrieved, and what action followed. Monitoring unusual memory writes, repeated failed checks, and tool calls based on unverified information can help identify a problem before it becomes an incident.
What This Means for Your Business
Businesses adopting AI agents should treat AI memory as part of the security architecture. It needs ownership, access rules, review processes, and a clear method for deleting or correcting information that should not have been stored.
The practical question is not whether agents can remember. It is whether the organisation can explain why a particular memory was trusted and what would happen if it turned out to be false.
AI can make business processes faster and more responsive, but convenience should not remove human judgement from decisions with financial, legal, privacy, or security consequences. If you are reviewing how AI tools connect to business data and workflows, our Cyber Security services page is a useful place to start.