Hunt Agent Memory Poisoning

OWASP Agentic ranks Memory Poisoning (T1) the top agent threat. When an agent has persistent memory — a stored user profile, remembered facts/preferences, a writable notes/scratchpad, or a writable knowledge base — an attacker can plant content that survives to future sessions and shapes the agent's behaviour without being re-injected each time. This is the difference from plain prompt injection: persistence + a write primitive. The severe forms: a durable backdoor that re-fires every session ("spAIware" = memory that instructs the agent to exfiltrate on each future conversation), and cross-user contamination where one attacker's write poisons other users/tenants.

Where This Lives / Attack Surface Signals

• Assistant advertises memory ("I'll remember that", "based on what you told me before"); a remember/save_note/update_profile tool.
• Behaviour/preferences carry across sessions (context survives a new chat).
• A writable knowledge base / RAG index the agent both reads and writes (overlaps hunt-agent-rag).
• Shared memory in a multi-agent system or a team/tenant-wide assistant (overlaps hunt-agent-multi-agent).
• The agent auto-memorizes from ingested content (documents, emails, conversations) — indirect write path.

Crown Jewel Targets

• Persistent backdoor: a stored instruction that re-fires every session (durable prompt injection).
• Persistent exfil (spAIware): memory that makes the agent leak the user's data on each future conversation (chains to hunt-agent-output-exfil).
• Cross-user/tenant poisoning: memory or knowledge shared across users → one write affects everyone (highest impact).
• Decision manipulation: poisoned "facts" the agent relies on for approvals/recommendations.