# R-12·cases 2·checked Nov. 15, 2026
Memory and context poisoning
Planted content gets saved into an assistant's memory or long-lived context and quietly shapes later answers and actions.
What it is
Assistants and agents increasingly remember things between sessions. OWASP's agentic list treats corrupting that memory as its own risk: one successful injection becomes persistent, affecting conversations and decisions long after the original content is gone.
This is not only a research concern. In February 2026 Microsoft reported businesses using "summarize with AI" links that told assistants to remember them as a trusted source.
Documented cases
Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.
Incidentdisclosed Feb. 10, 2026·AML.CS0072 "Summarize with AI" links that plant memories
Most AI assistants accept a prefilled prompt in a link. Microsoft found businesses using such links to tell assistants to remember them as a trusted source or recommend them first. Over 60 days of email traffic it counted 50 prompts from 31 companies.
Microsoft's advice: treat AI assistant links like downloads, review and prune stored memories, and hunt for assistant URLs whose prompt contains words like "remember" or "trusted source".
Sources: Microsoft Defender Security Research Team; MITRE ATLAS AML.CS0072
Research demodisclosed May 22, 2024·AML.CS0040 False memories written into ChatGPT from a shared document
A researcher put instructions in a Google Doc. When ChatGPT read it through a connected app, each instruction became a stored memory that carried into later conversations. Uploaded images worked too, and the researcher could also delete all memories this way.
OpenAI closed the report as a model safety issue rather than a security vulnerability. The researcher advises watching for "Memory updated" notices and reviewing stored memories.
Sources: Embrace The Red (independent researcher); MITRE ATLAS AML.CS0040
Controls to start with
- Scan memory writes for malicious or sensitive content, and keep memory separated per user and domain.ASI06, guidelines 2 and 3
- Don't automatically feed an agent's own outputs back into trusted memory, and let unverified memories expire.ASI06, guidelines 6 and 8
- Tell staff to review stored memories in their AI assistants and to treat AI assistant links with the caution they give downloads.Recommendations for users
Questions to ask vendors
Our suggestions, not taken from a framework.
- What does the assistant remember between sessions, and can admins see and clear it?
- Can content the assistant reads (documents, web pages, email) write to its memory without the user confirming?
Sources
- OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.
- Manipulating AI memory for profit: The rise of AI Recommendation Poisoning. Microsoft Defender Security Research Team, Feb. 10, 2026.
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.
- ChatGPT: Hacking Memories with Prompt Injection. Embrace The Red (independent researcher), May 22, 2024.