{"schema_version":"0.10.0","id":"LR-2026-0305","record_version":1,"title":"Microsoft red team: poisoned agent memory bypasses human-in-the-loop approval prompts","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"86b6d77cf4a859cd48e2b5db316f30fb7d24cad8d1553a70d93910997bfcc035"},"system":{"model_name":null,"model_version":null,"developer":"Microsoft","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"approve-each","guardrails_present":["action_approval"],"deployment_context":"evaluation","tier":null,"lifecycle_stage":"evaluation","integration_type":"agentic_with_tools","intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":["deception_or_concealment"],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"Microsoft's red team, in research reported in the Microsoft Digital Defense Report 2026, examined AI agents that can write to their own long-term memory and are given sensitive capabilities but told to ask the user before acting. The team observed approval prompts being triggered but ignored by an agent, and saw a policy stored in the agent's memory used to bypass approval within the same attack chain. Poisoned memory, delivered most commonly by email, is retrieved as trusted context in later sessions and can spread when memory is shared across tools, tenants or agents. Microsoft recommended separating trusted and untrusted write paths, treating the memory store as a high-value asset, and invoking approval checks deterministically by policy.","tags":["prompt-injection","agentic-ai","ai-agents","guardrail-bypass","memory-poisoning","red-team"],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"Attacker-controlled content written into agent memory is later retrieved as trusted context.","failure_class_detail":"Attacker-placed content written into agent memory is later retrieved as trusted context and used to bypass approval checks; classified from described behaviour (grade D).","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"Email","time_to_contain":null,"operations_paused":null,"remediation":"Microsoft recommends separating trusted and untrusted write paths so untrusted data cannot write to a trusted memory store. It also advises treating the memory store as a high-value asset, with users able to audit individual entries.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Contained to a red-team evaluation with no stated loss or third party affected (grade D: no source states a loss figure or scope).","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://idm.net.au/article/0015852-microsoft-warns-ai-agent-memory-poisoning","publisher":"Information & Data Manager","date":"2026-10-30","type":"press","title":"Microsoft Warns of AI Agent Memory Poisoning","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.developer":"C","system.autonomy_level":"C","system.guardrails_present":"C","system.deployment_context":"C","system.lifecycle_stage":"C","system.integration_type":"C","event.date_disclosed":"D","event.failure_class":"C","event.secondary_failure_classes":"C","event.trigger":"C","event.detection_method":"D","event.summary":"C","event.tags":"C","event.root_cause":"C","event.root_cause_detail":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.incident_class":"C","event.agent_involved":"C","event.failure_class_detail":"C","impact.severity":"C","impact.severity_because":"C","context.country":"D","context.denominator_available":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"Its red team found poisoned agent memory can suppress or bypass those checks."},{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"system.autonomy_level":[{"source_index":0,"quote":"Agents are given the capability but told to ask the user before doing anything sensitive."},{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"system.guardrails_present":[{"source_index":0,"quote":"The report says human-in-the-loop approval has become the default control whenever a new agent capability outpaces its classifiers."}],"system.deployment_context":[{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"system.integration_type":[{"source_index":0,"quote":"Many agents can write to their own long-term memory."}],"event.failure_class":[{"source_index":0,"quote":"It also saw a policy stored in the agent's memory used to bypass approval within the same attack chain."},{"source_index":0,"quote":"That content is then retrieved as trusted context in later sessions."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"Its red team found poisoned agent memory can suppress or bypass those checks."}],"event.trigger":[{"source_index":0,"quote":"An attacker who places content anywhere the agent reads can therefore place content it will remember."}],"event.summary":[{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."},{"source_index":0,"quote":"It also saw a policy stored in the agent's memory used to bypass approval within the same attack chain."},{"source_index":0,"quote":"Email is the most common delivery route, and a single poisoned entry can spread when memory is shared across tools, tenants or agents."},{"source_index":0,"quote":"Microsoft recommends separating trusted and untrusted write paths so untrusted data cannot write to a trusted memory store."}],"event.tags":[{"source_index":0,"quote":"Its red team found poisoned agent memory can suppress or bypass those checks."},{"source_index":0,"quote":"An attacker who places content anywhere the agent reads can therefore place content it will remember."},{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"event.root_cause":[{"source_index":0,"quote":"An attacker who places content anywhere the agent reads can therefore place content it will remember."}],"event.root_cause_detail":[{"source_index":0,"quote":"That content is then retrieved as trusted context in later sessions."}],"event.adversarial_actor":[{"source_index":0,"quote":"An attacker who places content anywhere the agent reads can therefore place content it will remember."}],"event.input_provenance":[{"source_index":0,"quote":"Email is the most common delivery route, and a single poisoned entry can spread when memory is shared across tools, tenants or agents."}],"event.remediation":[{"source_index":0,"quote":"Microsoft recommends separating trusted and untrusted write paths so untrusted data cannot write to a trusted memory store."},{"source_index":0,"quote":"Approval checks should be invoked deterministically by policy, so they cannot be bypassed by manipulating the model."}],"event.incident_class":[{"source_index":0,"quote":"Memory poisoning drives the problem."},{"source_index":0,"quote":"An attacker who places content anywhere the agent reads can therefore place content it will remember."}],"event.agent_involved":[{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"event.failure_class_detail":[{"source_index":0,"quote":"An attacker who places content anywhere the agent reads can therefore place content it will remember."},{"source_index":0,"quote":"That content is then retrieved as trusted context in later sessions."}],"impact.severity":[{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}],"impact.severity_because":[{"source_index":0,"quote":"Microsoft's red team observed approval prompts being triggered but ignored by an agent."}]},"notes_on_gaps":"The article reports a red-team finding from the Microsoft Digital Defense Report 2026; it gives no date for the observed behaviour, no model or product name, no harness, no loss figure, no affected-party count and no detection or containment timeline. date_disclosed is the article publication date (2026-10-30), not a stated disclosure date for the incident. The report's coverage window (July 2025 to June 2026) is not used as date_occurred. The agent's autonomy is inferred from the stated design (agents given capability but told to ask before sensitive actions) and the observed ignored approval prompts; the article does not state whether a human was monitoring. failure_class injection_triggered and secondary deception_or_concealment are classified from described behaviour (grade D). The article's statistics (165 trillion signals, 88% of enterprises experimenting, 45%/17%/14% attack prompt shares, 5.3-hour container exploit median) are background context, not quantities of this incident, and are not recorded. Country is left unknown because the article does not state where the red-team observation took place; the Australia figures concern cyber threats generally, not this incident. Extractor proposed values without quotes; dropped: ['context.country', 'context.denominator_available', 'event.date_disclosed', 'event.detection_method']. Single secondary source; corroborate before upgrading any field to B. [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null}}