Memory Poisoning: when the AI agent becomes the SOC's blind spot

This article, published in MISC 147, examines persistent agent memory as a security boundary in its own right. Agentic systems increasingly retain state between sessions — summaries of prior work, user preferences, retrieved documents, tool outputs, learned procedures. That retained state is read back into the model's context on later runs, where it carries the same authority as anything else the agent has been told. Memory, in other words, is not an inert cache: it is an input channel with write access from anywhere the agent reads.

The property that makes memory poisoning distinct from prompt injection is separation in time. The write and the effect are two different events, potentially days or weeks apart, potentially in different sessions, under different users, and in a different tool context. An attacker does not need to be present when the payload fires. They need only to arrange, once, for content that the agent will later treat as its own recollection — and then wait for a task whose reasoning path passes through it.

That separation is precisely what conventional SOC telemetry handles badly. Detection today is built around correlating events that are close together in time and attributable to an identity, a host, or a session. A poisoned memory record breaks all three assumptions at once. The eventual malicious action is performed by the agent's own legitimate identity, through sanctioned tools, in a session that looks unremarkable, and the causal write sits far outside any correlation window. Nothing in the sequence is anomalous in isolation; the anomaly is the relationship between two events that no pipeline currently joins.

• Memory writes are rarely logged as security-relevant events, so the originating action is often absent from the data the SOC holds.
• Recall is implicit: analysts cannot see which stored records shaped a given decision, or why they were retrieved.
• Agent identity collapses provenance — every downstream action shares one principal, regardless of who influenced the reasoning.
• Existing detection content assumes bounded sessions, which agent memory deliberately outlives.

The direction of defence the article argues for is not filtering harder at the input. It is treating memory as governed data. That means provenance carried on every stored record — origin, authoring context, trust level — so a memory's lineage survives into the moment it is used; policy evaluated at recall rather than only at write, so that low-trust content cannot silently reach a high-privilege reasoning path; and observability that makes retrieval a first-class telemetry event, letting a SOC reconstruct which memories informed which decisions. The framing is mapped against MITRE ATLAS and OWASP work on agentic and LLM risk, and the governance question — who may write to an agent's memory, and under what accountability — is treated as inseparable from the technical one.