Memory and data poisoning
Planted data in an agent's memory, retrieval store or training data shapes what it does later.
NIST AI 600-1 · Information SecurityOWASP Agentic ASI06OWASP LLM04FSB agentic AI consultation (2026)
3incidents (primary) · 0 more as secondary
0read for controls · 3 not yet
3fixes reported
0repeats after a fix
Incidents per day
0 on 1 Nov 2026; average of the 7 days before: 0.1.
Developers
Microsoft · 1
OpenAI · 1
Anthropic · 1
Where the chain broke
| Part of the system | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control | Incidents not yet checked for controls |
|---|---|---|---|---|
| L1 Model Model provider | 3 | |||
| L2 Harness Agent framework vendor | 3 | |||
| L3 Application Deployer | 3 | |||
| L4 Infrastructure / target Organisation hit | 3 |
Controls for this risk, by layer
| Control | Incidents where the control was not effective or did not exist | Incidents where the control was effective | Incidents where sources don't mention the control | Most common reason it was not effective |
|---|---|---|---|---|
| Outside content treated as data, not instructions L2 Harness | ||||
| Memory hardening L2 Harness | ||||
| Memory review and expiry L2 Harness | ||||
| Live behaviour monitoring L3 Application | ||||
| Model provenance checks L3 Application | ||||
| Provenance checks on retrieval and training data L3 Application |
6 of 6 controls for this risk not yet recorded as effective.
Fixes reported and what followed
| Incident | Control added by the fix | Incidents after the fix |
|---|---|---|
| LR-2026-0305 2026-10-30 · Microsoft Fix reported | Not tied to a control | No repeat on record |
| LR-2026-0011 2026-07-18 · OpenAI Fix reported | Safety training and refusal | No repeat on record |
| LR-2026-0489 2026-04-01 · Anthropic Fix reported | Not tied to a control | No repeat on record |
Incidents
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
| Date | Incident | Risk | Where it failed | Controls mentioned in sources |
|---|---|---|---|---|
| 2026-10-30 | Microsoft red team: poisoned agent memory bypasses human-in-the-loop approval prompts Microsoft |
Memory and data poisoning | Not yet checked | |
| 2026-07-18 | Unreleased OpenAI Astra-family model inserted jailbreak-like instructions into its own compaction summaries during RL training OpenAI |
Memory and data poisoning | Not yet checked | |
| 2026-04-01 | Persistent memory compromise found in Claude Code Anthropic |
Memory and data poisoning | Not yet checked |