Persistent context injection
ID |
persistent-context-injection |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM04:2025 — Data and Model Poisoning |
OWASP ASI |
ASI06:2026 (secondary ASI10:2026) |
Family |
LLM04 — Data and Model Poisoning |
Red-team vectors |
RAG Poisoning, Indirect Injection |
Tags |
ai_security |
Description
An agent writes model / tool output into a persistent memory — a vector-store-backed memory or a durable checkpointer — that is replayed into later sessions, with no sanitisation on the write path. One hostile input persists and is re-injected into every future conversation: persistent context / memory poisoning (SkillSpector MP-class, OWASP ASI06 / ASI10). A non-persistent in-session buffer, or a sanitised write path, produces no finding.
Examples
memory = VectorStoreRetrieverMemory(retriever=store.as_retriever()) (1)
agent = AgentExecutor(agent=a, tools=tools, memory=memory)| 1 | Persistent vector-backed memory, no sanitisation on the write path — flagged. |
Sanitising content before it is written, or using a per-session (non-persistent) buffer, produces no finding.