Cross-Session Poisoning

The attacker injects malicious content into the agent's persistent memory store—such as a vector database, conversation log, or knowledge graph—rather than a transient context window. This payload is then recalled during future sessions, often weeks or months later, when a different user triggers a semantically related query. The attack exploits the agent's retrieval-augmented generation (RAG) pipeline to surface the poisoned memory as authoritative context.

• Payloads survive session termination and server restarts
• Exploits the trust boundary between short-term working memory and long-term storage
• Often combined with metadata spoofing to boost retrieval ranking

A single poisoned memory entry can influence the behavior of every subsequent user whose session triggers retrieval of that entry. This creates an asymmetric attack surface: one injection point yields a multiplicative impact across the entire user base. In multi-tenant agent deployments, a poisoned document ingested for one organization can bleed into the reasoning of another if memory partitioning is insufficient.

• One injection can compromise hundreds of independent user sessions
• Exploits shared memory architectures in multi-tenant systems
• Particularly dangerous in customer-facing agent deployments

Cross-session poisoning enables multi-stage attack chains that unfold over extended time periods. The attacker first plants a dormant payload in memory. In a later session, a second trigger—such as a specific user query or tool invocation—activates the payload. This temporal decoupling makes forensic attribution extremely difficult, as the injection event and the exploitation event are separated by days or weeks.

• Stage 1: Payload injection into long-term memory
• Stage 2: Dormant persistence across sessions
• Stage 3: Trigger-based activation via retrieval
• Stage 4: Exploitation in a new, unrelated user session

A specific variant where the attacker corrupts the agent's episodic memory buffer—the log of past interactions used for reflection and planning. By injecting falsified 'experiences' into this buffer, the attacker causes the agent to recall and act upon synthetic past events as if they were genuine. During reflection loops, the agent may cite these fabricated memories as justification for malicious actions.

• Targets the agent's self-reflection and planning mechanisms
• Fabricated experiences are indistinguishable from genuine interaction history
• Exploits the agent's learned trust in its own memory store

The attacker injects malicious dialogue turns directly into the multi-turn conversation log stored between sessions. When the agent reloads this history in a future session, it accepts the attacker-established premises, role-playing constraints, or false factual assertions as established context. This is particularly effective against agents that use conversation history for personalization and continuity.

• Injected turns appear as legitimate prior interactions
• Establishes false premises that persist across session boundaries
• Can force the agent into a constrained role or persona for all future users

The attacker inserts malicious vector embeddings into the agent's vector database, exploiting the nearest-neighbor retrieval mechanism. Because vector search operates on semantic similarity rather than exact matching, a poisoned embedding can be surfaced for a wide range of benign queries that happen to be semantically adjacent. The attack corrupts the ANN index structure itself, altering graph navigation paths to favor adversarial content.

• Exploits the fuzzy nature of semantic search
• A single poisoned vector can contaminate multiple query neighborhoods
• Often combined with HyDE attacks to skew hypothetical document embeddings

The corruption of an agent's episodic memory buffer, causing it to recall and act upon falsified past interactions. This attack targets the reflection and planning loops of cognitive architectures by injecting synthetic experiences into the agent's long-term memory store.

• Corrupts the experience replay mechanism used in agentic learning
• Causes the agent to learn from fabricated successes or failures
• Particularly dangerous in agents with recursive self-improvement capabilities

The injection of malicious dialogue turns into a multi-turn conversation log. This attack establishes false premises, role-playing constraints, or fabricated user preferences that the agent accepts as established context for all subsequent interactions.

• Exploits the conversational grounding assumption
• Attacker-crafted turns become in-context few-shot examples
• Can manipulate the agent's perceived user identity and authorization level

The manipulation of an agent's recursive summarization process. As context windows fill, agents compress earlier interactions into summaries. Attackers exploit this by planting content that, when summarized, drops critical safety instructions or distorts key facts.

• Targets the compression boundary where fidelity is lost
• Safety instructions are often the first casualty of aggressive summarization
• Creates a sleeper effect where poison activates only after summarization

The injection of malicious reasoning steps into an agent's scratchpad or reflection loop. By planting a flawed logic chain, attackers cause the agent to adopt an incorrect reasoning trajectory that leads to an attacker-intended conclusion while appearing internally consistent.

• Exploits the agent's self-consistency verification
• Malicious reasoning appears as legitimate step-by-step analysis
• Can bypass output filters by making harmful conclusions seem logically derived

The manipulation of the transformer's KV cache during inference to alter attention patterns. This low-level attack modifies the cached key-value pairs from previous tokens, causing the model to attend to adversarial tokens over legitimate context without modifying the visible input.

• Operates below the token-level visibility threshold
• Requires access to the inference runtime memory
• Can persist across multiple generation steps in autoregressive decoding