Memory is what lets AI agents learn preferences, carry context between sessions and work on long tasks. It is also a new place for attacks and data leaks. Content written to memory today can change an agent's behaviour weeks later. Memory shared across users can move one person's data into another's answers. Memory that is kept indefinitely accumulates sensitive information, and sometimes credentials, that nobody meant to store. This guide explains how agent memory works, the risks it creates, including memory poisoning and cross-user leakage, and the controls that keep it safe.
Key takeaways
- Agent memory includes short-term context, long-term memory stores, shared scratchpads and retrieved knowledge. Each needs access control and retention rules.
- Memory poisoning (OWASP ASI06) lets attackers plant instructions or false facts that persist and influence future actions.
- Isolate memory per user, session and task, and never let one principal's memory reach another's without explicit design.
- Never store secrets in memory; validate what is written; log changes; set retention; allow reset.
Types of agent memory
| Type | Description | Main risks |
|---|---|---|
| Context window | Current conversation and retrieved content | Injection; sensitive data sent to model provider |
| Session memory | State kept during a task or session | Leakage between tasks if not cleared |
| Long-term memory | Facts, preferences and summaries stored across sessions | Poisoning; accumulation of sensitive data; cross-user leakage |
| Shared memory | Scratchpads or state shared between agents in a system | One compromised agent influencing others |
| Knowledge stores | Vector indexes and documents used for retrieval | Permission bypass; poisoning. See the Permission-Aware RAG Guide |
Risks
- Memory poisoning: malicious content, such as an email or document, causes the agent to store an instruction ("always approve invoices from this supplier") or a false fact that shapes later behaviour.
- Cross-user leakage: an agent serving many users recalls one user's details in another user's session.
- Privilege confusion: memory created under a privileged user's session is later available to an agent acting for a less privileged user.
- Sensitive data accumulation: personal data, confidential content and occasionally credentials stored long-term without classification or retention limits.
- Tampering: direct modification of memory stores by anyone with access to the underlying database.
- Drift: gradual accumulation of memories that push the agent away from its intended behaviour.
Controls
Isolation and access control
- Partition memory by principal (user or tenant), agent and task; enforce partitioning in the data layer, not only in the prompt.
- Tag memory entries with the identity and permission context under which they were created, and only retrieve entries the current principal may see.
- Protect memory stores with their own least-privilege identities and encryption. See Securing AI Infrastructure Workload Identities.
Write controls
- Do not write raw external content to long-term memory; store structured, validated summaries.
- Block instruction-like content, such as "always", "ignore previous" or policy-changing statements, from being stored as memory, or route it for review.
- Require confirmation for memories that change goals, rules or trust decisions.
- Never store credentials, tokens or keys; scan memory for secrets.
Visibility and lifecycle
- Log all memory writes, updates and deletions with source and identity.
- Let users view and delete what the agent remembers about them.
- Set retention periods; expire and re-baseline long-term memory periodically.
- Be able to roll back or wipe memory after an incident. See the AI Agent Observability and Incident Response Guide.
Multi-agent systems
- Avoid shared memory between agents with different trust levels.
- Validate information passed between agents before storing it. See the Multi-Agent and A2A Security Guide.
Privacy considerations
- Agent memory of personal data is processing under data protection law; apply purpose limitation, minimisation, retention and data subject rights.
- Document what is remembered and why in privacy notices.
Practitioner checklist
- Map every memory type your agents use and where it is stored.
- Partition memory by user, tenant, agent and task, enforced in the data layer.
- Validate and summarise before writing; block instruction-like content.
- Never store secrets in memory; scan for them.
- Log memory changes; allow users to view and delete.
- Set retention and re-baseline periodically; be able to wipe after incidents.
Standards and references
- OWASP Top 10 for Agentic Applications for 2026: ASI06 Memory and Context Poisoning
- OWASP Top 10 for LLM Applications (2025): LLM02, LLM04
- CSA MAESTRO
Related NHI Mgmt Group resources: Agentic AI Security Guide · Permission-Aware RAG Guide · Threat Modelling AI Agents · OWASP Agentic Top 10 Guide
