Memory Is a Feature. It Is Also an Attack Surface

2026-05-14 · Source: OWASP Gen AI Security Project · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Advanced, short

Summary

Cisco research identified "MemoryTrap," a critical vulnerability in Claude Code, demonstrating how agentic AI systems' persistent memory and context can become an attack surface. Discovered by Idan Habler and the ASI Core Team, this finding directly relates to OWASP ASI06: Memory & Context Poisoning. The vulnerability allowed a routine developer workflow—cloning a repository and installing dependencies—to result in persistent prompt injection. Malicious payloads reached persistent memory, global hooks configuration, and even influenced the system prompt, enabling a one-time action to shape the model's future behavior across sessions and projects. This highlights that helpful agent behavior can inadvertently create entry points for persistent compromise. Anthropic addressed the specific high-trust override path in Claude Code v2.1.50 by removing user memories from the system prompt. The broader lesson emphasizes that memory, summaries, and local state in agentic tools must be treated as security-relevant control surfaces, not just convenience features.

Key takeaway

For AI Security Engineers designing or auditing agentic applications, recognize that persistent memory and context are not merely features but critical attack surfaces. You must apply the same rigorous scrutiny to an agent's retained context, summaries, and local state as you would to execution paths or credentials. Failing to validate and separate persistent context increases the risk of persistent prompt injection, turning routine workflows into long-term compromises. Implement robust validation, separation, and visibility mechanisms for all memory-related components.

Key insights

Agentic AI memory, context, and local state are critical attack surfaces, enabling persistent compromise beyond single interactions.

Principles

• Agentic systems' persistent memory is a security-relevant state.
• Helpful agent behavior can become an attack entry point.
• Attacker-controlled content can poison trusted system surfaces.

In practice

• Scrutinize agent memory like execution paths and credentials.
• Validate and separate persistent context in agentic tools.
• Increase visibility into agent memory and local state.

Topics

• Agentic AI Security
• Memory Poisoning
• Context Poisoning
• Prompt Injection
• OWASP ASI06
• Claude Code Vulnerability
• Persistent Compromise

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Engineer, AI Architect

Related on AIssential

• Defending your Memory in Microsoft Foundry Agent Service against memory poisoning — Agent memory, while enabling continuity, creates a security boundary vulnerable to persistent poisoning, requiring write-path validation.
• ElephantAgent: Contextual State Continuity in Agentic Systems — ElephantAgent ensures verifiable contextual state continuity to defend agentic systems against poisoning attacks.
• Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems — Persistent memory in agentic systems introduces a distinct and potent prompt injection attack surface.
• A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle — LLM agent memory's inherent malleability necessitates lifecycle-wide security governance for mnemonic sovereignty.
• AI Agents Have Amnesia. A Bigger Context Window Won’t Cure It. — AI agents require a dedicated, architected memory layer to overcome inherent amnesia, as context windows are buffers, not durable truth models.
• The AI Agent Security Surface: What Gets Exposed When You Add Tools and Memory — AI agents introduce four distinct attack surfaces requiring a new security paradigm beyond traditional LLM prompt defenses.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by OWASP Gen AI Security Project.