Memory & Context Attacks

Injection of malicious or manipulative information into an agent's long-term memory systems, corrupting its knowledge base and influencing future behaviors.

Exploitation of context window limitations to hide malicious instructions, overflow context buffers, or manipulate conversation history to bypass security controls.

Injection of malicious documents or data into Retrieval-Augmented Generation (RAG) knowledge bases to poison retrieved context and manipulate agent responses.

Unauthorized takeover of an ongoing agent conversation or session, gaining access to conversation history, context, and the ability to inject malicious instructions.

Direct injection of malicious content into an agent's memory storage systems, bypassing normal conversation flows to insert false memories or corrupted knowledge.

Gradual contamination of conversation context through subtle injections across multiple interactions, slowly corrupting the agent's understanding and behavior.

Manipulation of episodic memory replay mechanisms to reinforce malicious patterns, false information, or harmful behaviors through repeated memory activation.

Corruption of an agent's semantic memory - general knowledge and facts - through injection of false information that becomes part of the agent's core understanding.

Exploitation of memory persistence mechanisms to ensure malicious content remains in agent memory across resets, updates, or cleanup operations.

Exploitation of memory isolation vulnerabilities to access or leak information from other users' sessions or conversations through shared memory systems.

Attacking agent learning processes by introducing biased, incomplete, or malicious data during incremental updates, online learning, or feedback loops, causing the agent to learn harmful behaviors or incorrect patterns.

Exploiting vulnerabilities in the agent's knowledge update mechanisms by injecting unauthorized updates, bypassing authentication and integrity checks, or manipulating version control systems to introduce malicious knowledge.

Attacking shared knowledge bases used by multiple agents to create systemic poisoning, where corrupted knowledge propagates across interconnected agents, causing cascading errors and compromised decision-making throughout the agent network.