Prompt injection can poison an agent’s long-term memory across sessions: why it is not safe to use

What happened

On August 10, 2026, ITPro reported on Forcepoint research describing “persistent memory poisoning” in AI assistants and agentic systems. In simple terms, this means a bad prompt or hidden instruction can be placed in a web page, document, or message, then stored in an agent’s memory as if it were a real fact.

According to the report, the planted false information could include fake vendors, support contacts, approval chains, or security rules. The concern is that the agent may later retrieve those items as trusted information, even months after the original interaction. Forcepoint said this is different from ordinary prompt injection because it can continue across sessions instead of ending when one chat ends.

The article says possible delivery channels include compromised web pages, shared documents, support tickets, email footers, Slack or Teams messages, PDFs with hidden text, and knowledge-base articles.

What it means for you

If you use an AI agent for work, do not assume its memory is always correct just because it sounds confident or remembers something from before. Details about contacts, vendors, approvals, and security steps may need checking, especially if they came from a document or message the agent read earlier.

What to do instead

Ask the agent to show the source for important facts. Re-check names, contact details, payment instructions, and approval steps against your official systems. Be careful with shared files, copied text, and support messages from outside your team. For higher-risk tasks, keep a human review step before acting. AgentPod lists only reviewed, tested skills, which can help reduce risk, but you should still verify important information.

Sources:

• https://www.itpro.com/security/trust-your-ai-agents-new-research-shows-memory-poisoning-can-dupe-them-into-remembering-fake-information-and-its-a-huge-security-risk