Agent memory poisoning

에이전트 메모리 오염

A poisoned memory can persist into later tasks and redirect answers or actions.

···
html
<div class="sd"><div class="sd-head"><strong>MEMORY POISONING</strong><span id="state">live check</span></div><div class="sd-stage"><div class="mp-timeline"><div><b>NOW</b><span>external note</span></div><div><b>STORE</b><span id="memory">unchecked memory</span></div><div><b>LATER</b><span id="later">new task</span></div></div><div class="mp-marker" id="marker">QUARANTINE</div></div><div class="sd-foot"><span id="caption">checking boundary</span><span>tap to step</span></div></div>
css
.sd{box-sizing:border-box;width:min(94vw,700px);height:min(86vh,318px);padding:clamp(9px,2.3vmin,18px);border:1px solid var(--line);border-radius:14px;background:var(--surface);color:var(--fg);display:flex;flex-direction:column;gap:clamp(6px,1.8vmin,12px);font:600 clamp(12px,2.6vmin,16px)/1.25 var(--font-sans, sans-serif)}.sd *{box-sizing:border-box}.sd-head,.sd-foot{display:flex;align-items:center;justify-content:space-between;gap:8px;min-height:1.25em}.sd-head strong{color:var(--accent);letter-spacing:.06em}.sd-head span,.sd-foot{color:var(--muted)}.sd-foot{font-size:clamp(12px,2.4vmin,14px)}.sd-stage{position:relative;flex:1;min-height:0;display:flex;align-items:center;justify-content:center;gap:clamp(6px,2vmin,18px);overflow:hidden}.sd .mono{font-family:ui-monospace,monospace}.sd .tile{border:1px solid var(--line);border-radius:8px;background:var(--bg);padding:clamp(5px,1.5vmin,10px);text-align:center}.sd .good{color:var(--accent);border-color:var(--accent)}.sd .bad{color:var(--accent-3);border-color:var(--accent-3)}.sd .arrow{color:var(--muted);font-size:clamp(15px,4vmin,28px)}.sd .active{background:color-mix(in srgb,var(--accent) 16%,var(--surface));border-color:var(--accent)}.sd .blocked{background:color-mix(in srgb,var(--accent-3) 13%,var(--surface));border-color:var(--accent-3)}.sd-stage{flex-direction:column}.mp-timeline{display:flex;width:100%;gap:clamp(4px,1.4vmin,12px);position:relative}.mp-timeline:before{content:'';position:absolute;top:18px;left:10%;right:10%;border-top:2px solid var(--line)}.mp-timeline>div{position:relative;flex:1;display:grid;gap:clamp(5px,1.5vmin,10px);text-align:center}.mp-timeline b{border:1px solid var(--line);border-radius:50%;background:var(--surface);width:clamp(42px,13vmin,70px);height:clamp(42px,13vmin,70px);display:grid;place-items:center;margin:auto;color:var(--accent)}.mp-timeline span{font-size:clamp(12px,2.4vmin,14px)}.mp-timeline .poison{color:var(--accent-3)}.mp-marker{border:1px solid var(--accent-3);border-radius:6px;padding:clamp(3px,1vmin,7px);color:var(--accent-3);opacity:.75;transition:opacity .2s}.mp-marker.on{opacity:1}
js
let n=-1;function advance(){n=1-n;document.getElementById('memory').classList.toggle('poison',!!n);document.getElementById('later').textContent=n?'blocked reuse':'new task';document.getElementById('marker').classList.toggle('on',!!n);document.getElementById('state').textContent=n?'source untrusted':'memory stored';document.getElementById('caption').textContent=n?'check provenance before future use':'unverified note enters memory'}advance();setInterval(advance,1000);
document.querySelector('.sd').addEventListener('pointerdown',advance);

Memory poisoning stores hostile external content in an agent’s long-term memory or summaries, allowing it to affect later tasks. Unlike a prompt injection confined to one read, the influence persists across sessions.

The timeline shows ingestion, storage, and a later task, with an unverified memory quarantined before reuse. Keep provenance and trust metadata with memories, and revalidate before sensitive actions.

When to use

Apply it when agents save and reuse web, document, or conversation content as long-term memory.

Open as page ↗