.png&w=828&q=75)
LLMs have recently adopted persistent memory to provide models with better user knowledge and personalisation. However, this introduces a new vector for adversarial manipulation. This report investigates Memory Injection, a threat model where adversaries exploit indirect prompt injection within web content to poison an agent's long-term memory. Employing user manipulation scenarios, we show that memory attacks, should they succeed, are effective at changing model behaviour towards the user, often more so than a direct system prompt. Hence, this highlights the need for more robust evaluations of memory updates in agentic memory systems.
7 Feb 2026