Memory & Context Poisoning is item 6 of the OWASP Top 10 for Agentic Applications 2026 (ASI06): attacks where an adversary corrupts an agent's memory or retrieved context so that the corruption keeps biasing the agent's decisions long after the original interaction that planted it.

What sets ASI06 apart from ASI01: Agent Goal Hijack is persistence. A hijacked goal ends when the session ends. A poisoned memory, or a poisoned piece of retrieved context, keeps influencing every future invocation that reads it, whether that's the very next message or a session that starts weeks later.

ASI01 fades when the session closes. ASI06 doesn't, and can re-trigger on its own.

This room builds directly on Data Poisoning in RAG Systems, an earlier room that covered corrupting a static RAG or embedding corpus from the outside. OWASP treats memory and context as the same underlying risk: anything an agent retains, retrieves, or reuses, so ASI06 doesn't split cleanly into a "memory" attack versus a "context" attack. Task 2 covers the mechanism underneath all of it: an agent that autonomously writes to, and later reads from, its own persistent memory. Task 3 then covers two of OWASP's own named examples of this risk: RAG poisoning, the same mechanism as that earlier room now applied to an agent's own retrieval step, revisited here only as a callback; and context-window manipulation, via saturation, new material unique to agentic context windows.

The room before this one, ASI05: Unexpected Code Execution, showed code running because nobody reviewed it: a value, a cached object, a script the agent wrote itself, all of it traceable within the same session, once you knew where to look. This room removes that guarantee. What you are chasing here did not happen in the session you are reading. It happened however long ago the write landed, in a session that is already over.

The Scenario

This room sits inside TryTrainMe's agent estate, the same fictional company from the AI Security path, a year on. You are the security engineer who owns this estate: you did not build it, and you are accountable for it regardless.

Tasks 4 and 5 cover two real, named, publicly documented incidents. Both actually happened, to real products, and both are worth reading in full from their original sources, linked throughout this room.

Learning Objectives

• Explain what distinguishes ASI06 from ASI01 and from the RAG/data poisoning covered in Data Poisoning in RAG Systems.
• Name the store or mechanism ASI06 poisoning can target: an agent's own memory, its RAG retrieval corpus, or its context window.
• Trace the attack chain of a real, published memory-poisoning incident from initial delivery to persistent effect.
• Match a given ASI06 scenario to the mitigation(s) that would have closed it.

Prerequisites

• Data Poisoning in RAG Systems: RAG, embedding, and corpus poisoning fundamentals.
• Agentic Fundamentals: Agent vs. LLM, tool use, and the basic idea of agent memory.
• Agentic Threat Modelling: The generic agent attack surface, memory included as one node among several.
• ASI01: Agent Goal Hijack: Needed to contrast a session-bound goal hijack against ASI06's persistence.