Memory poisoning
Also called memory and context poisoning, context poisoning, poisoned memory
Planting false information in what an AI agent remembers, so that it keeps shaping the agent's decisions in later sessions.
An agent's memory is a store of text that is put in front of the model again on later runs. The model treats it as something it already knows. Memory poisoning is getting a false line into that store.
The line can arrive in anything the agent reads: an email, a ticket, a shared document. Once saved, it waits. It may be recalled days or weeks later, in a different session and for a different person, and acted on as settled fact. Whoever wrote it never has to come back.
That delay is what sets it apart from an instruction hidden in a single document, which ends with the session. A poisoned entry lasts until someone finds it and removes it, so memory needs rules of its own: what may be stored, a recorded source for every entry, separation between users, and an expiry.
For example
An email tells an agent that refunds to one account are pre-approved. The agent saves the note, and weeks later it pays a refund to that account for a different user.
Put it to use
Where you'll meet memory poisoning in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.