Eighth page in Operation Scarecrow. If you haven't read the argument page and the four memory-type pages yet, start there. Source citations at the foot of this piece.
This isn't a hypothetical anymore. OWASP added Memory and Context Poisoning to its 2026 Agentic AI Top 10 as its own category — ASI06 — explicitly because agentic systems have an attack surface the older LLM Top 10 never covered: an agent that doesn't just process untrusted input once, but carries it forward and acts on it again, in a later, unrelated session, having no idea the input was ever untrusted. The category prescribes five defense layers — input moderation, memory sanitization with provenance, trust-aware retrieval, behavioral monitoring, and forensic capability — and its governance requirements read like a direct echo of what this section has already been arguing for on entirely separate grounds: provenance metadata on every write, tenancy separation, deliberate forgetting windows, and periodic evaluation against ground truth.
Three named attacks, and what each one actually targets
AgentPoison is a backdoor attack against RAG-based and memory-based agents: a handful of poisoned demonstrations, each pairing a trigger phrase with an adversarial target action, gets planted in an agent's long-term memory or knowledge base. No model retraining required. Reported results: at least 80% attack success at under 0.1% poison rate, with under 1% impact on benign performance — meaning the poisoned memory is nearly invisible until the trigger fires. It's been demonstrated against a RAG-based autonomous-driving agent, triggering a dangerous sudden-stop action; a knowledge-intensive QA agent; and a healthcare records agent.
MINJA — Memory Injection Attack — is more concerning structurally, because it needs no direct access to the memory store at all. An attacker poisons the agent's memory purely by interacting with it through ordinary queries, getting the agent to generate its own "bridging" reasoning steps that link an innocent-looking query to a malicious target, then progressively removing the scaffolding that produced those steps so the resulting memory entry looks organic once it's stored and later retrieved. Reported: 98.2% injection success, 76.8% attack success. This is the one that matters most for anything built on the assumption that memory only gets written through an approved, mandated-practice channel — MINJA shows the write path can be a side effect of normal use, not a deliberate submission anyone would flag.
Semantic Norm Drift is the sharpest of the three for this framework specifically, because it doesn't attack a retrieval index — it attacks a shared, persistent knowledge base that's already functioning as a settled-facts store, using nothing more than document-upload access, a permission routinely granted to compliance staff and ingestion pipelines. One policy-formatted document gets an agent producing policy-violating outputs with no model failure and no misalignment, nothing a behavioral audit would catch, because the model isn't broken — it's correctly following a fact that shouldn't have been treated as settled in the first place. Worse, the standard incident response of retraining the model doesn't remove the poisoned entry, consumes real governance resources, and produces a false remediation record while the actual problem stays exactly where it was. A real, if thinly documented, production instance of this general class has already surfaced: the MemoryTrap vulnerability reported in Claude Code, where attacker-controlled content poisoned memory and context that the system kept trusting over time.
Where this actually lands on the four tiers
Working memory is the least consequential tier to poison, structurally rather than by luck — it's scoped to one task and dies with it, so an attack here can't outlive the session it targets, even though it can still cause real harm within that one session.
Episodic memory is where AgentPoison and MINJA actually live. Both attacks work by getting a fabricated "past experience" planted in exactly the store this section calls episodic — a dated, retrievable precedent — and both rely on it later being retrieved as if it were a legitimate prior decision. That's not a coincidence. Episodic memory is designed to be trusted more than a cold query specifically because it represents something that already happened, which is exactly the property an attacker wants to borrow.
Semantic memory is the highest-value target, and this section's own governance argument is directly exposed here. Semantic Norm Drift works precisely because semantic memory is the tier meant to be trusted without re-verification — that's the entire point of promotion. An attacker doesn't need to fabricate three independent confirming episodes if they can get one document treated as already-settled, skipping the promotion gate entirely. And the promotion gate has a second, subtler failure mode worth naming plainly: the consolidation mechanism this section argues for — promote a fact only once it's been independently confirmed across separate contexts — assumes independence is hard to fake. It isn't. An adversary who can seed multiple superficially unrelated episodic entries can manufacture the appearance of independent convergence and walk a false fact straight through the promotion gate that was supposed to be the safeguard. This is the same failure mode this section flags elsewhere as an accident — five teams "confirming" an assumption they all inherited from one all-hands slide isn't independent evidence, it's an echo — except here the echo is deliberately manufactured. The defense is the same either way: provenance tracking on every episodic entry, checked at promotion time, not just at retrieval time.
Procedural memory is the most operationally dangerous tier to poison, because it's the only one that acts rather than informs. AgentPoison's own test cases make this concrete — the "adversarial target" in the autonomous-driving case wasn't a wrong fact, it was a dangerous action the agent actually took. This is the sharpest version yet of this section's own line that getting procedural memory wrong looks like a bug, not a misunderstanding: here it's not an accidental bug, it's a deliberately planted one, which is exactly why procedural memory's engineering-grade review already functions as a provenance gate, even though nothing in this section named it that until now.
| Tier | Attack(s) that land here | Reported success | Why here specifically |
|---|---|---|---|
| Working | None named | — | Scoped to one task; an attack here can't outlive the session it targets |
| Episodic | AgentPoison, MINJA | ≥80% attack success (AgentPoison); 98.2% injection / 76.8% attack success (MINJA) | Designed to be trusted as "something that already happened" — exactly the property an attacker wants to borrow |
| Semantic | Semantic Norm Drift | Not rate-benchmarked — works via a single ingested document | Meant to be trusted without re-verification; skips the promotion gate entirely |
| Procedural | AgentPoison (action-triggering cases) | See AgentPoison above | The only tier that acts rather than informs — a planted action, not just a wrong fact |
The three named attacks above, mapped onto the four tiers this section already argues need different governance — the same split that motivates the governance also happens to explain where each attack actually lands.
The defense stack, and the one number worth remembering
Provenance tagging — source, timestamp, a confidence score, and the ingestion path attached to every memory write — is the mechanism the research is converging on. One paper reports attack success dropping to zero at every tested budget once a provenance gate is in place, because injected entries score below the trust threshold before they're ever acted on. That maps cleanly onto three layers this section was already arguing for on other grounds: a write-time gate — the steward and mandated-practice governance this section already argues for per tier, now doing double duty as a poisoning defense; a read-time filter — trust-aware retrieval, scoring a source's reliability before an agent acts on what it returns; and a post-hoc layer — tools built for causal-attribution and structural-anomaly detection after the fact, the forensic capability OWASP's ASI06 calls for directly. None of this was designed as security architecture. It turns out to double as one.
A real production analog for the read-time and forensic layers already exists, outside any security framing: "The Best Context, In Practice: A Bot Named Chiefys" describes an internal tool that audits a curated document set for internal contradictions and forces a decision — retire it, or declare the conflict intentional — rather than letting a stale or wrong entry sit unflagged. It wasn't built as a poisoning defense. A scheduled contradiction-audit against a small, trusted set is functionally the same mechanism this page is arguing for, arrived at from a completely different motivation.
The gap the defense doesn't close
One failure mode here still doesn't have a clean fix anywhere in the research behind this section. If a poisoned semantic fact produces bad behavior that looks exactly like ordinary model imperfection, the standard response — retraining or patching the model — actively makes things worse: it consumes remediation effort without removing the actual cause, and leaves behind a false sense the problem is fixed. Whether this section's own supersede-don't-edit rule for episodic memory helps here or is simply irrelevant is untested. Superseding a poisoned entry stops it from being cited as current going forward, but it doesn't explain why a provenance check failed to catch it at write time in the first place, and it doesn't retroactively unwind whatever decisions already got made downstream of it while it was still trusted.
Sources. OWASP GenAI Security Project, "OWASP Top 10 for Agentic Applications" and "Memory Is a Feature. It Is Also an Attack Surface" — source of the ASI06 category, the five prescribed defense layers, and the MemoryTrap-in-Claude-Code reference — genai.owasp.org. AgentPoison: Chen et al., "AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases," arxiv.org/abs/2407.12784. MINJA: "Memory Injection Attacks on LLM Agents via Query-Only Interaction," NeurIPS 2025, arxiv.org/abs/2503.03704. Semantic Norm Drift and the Misattribution Gap: "The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems," arxiv.org/pdf/2605.22842. Provenance-based defense and trust scoring: "When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defense," arxiv.org/html/2606.22030. Post-hoc forensic auditing: "MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection," arxiv.org/pdf/2605.23723. Additional background: "From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents," arxiv.org/html/2606.04329v1.