Context and memory poisoning are techniques that manipulate what an agent reads in the moment or stores for later use. The first shapes immediate responses and tool calls within a session, while the second persists across sessions. Both can steer behaviour gradually, making compromise look like normal reasoning drift.
Expanded Definition
Context and memory poisoning refers to manipulating the information an AI agent uses for immediate reasoning or stores for later recall. In NHI operations, this can affect tool selection, retrieval, policy interpretation, and long-lived memory entries that survive beyond a single interaction. The distinction matters: context poisoning changes what the agent treats as true right now, while memory poisoning corrupts what it will treat as true in a later session. Industry usage is still evolving, so some teams group both under broader prompt injection or agentic manipulation, but the operational risk is more specific when an agent has execution authority and persistent memory.
For governance purposes, the relevant question is not whether the input looks malicious, but whether it can alter decisions with privileged downstream effects. That is why NHI controls must treat retrieved documents, chat history, vector stores, and cached summaries as security-sensitive inputs. Guidance from the OWASP Top 10 for Agentic Applications 2026 is especially relevant because it frames agentic systems as attack surfaces rather than passive interfaces. The most common misapplication is assuming memory is trustworthy by default, which occurs when organisations let agents retain unreviewed facts across sessions.
Examples and Use Cases
Implementing memory controls rigorously often introduces latency and review overhead, requiring organisations to weigh better agent reliability against slower automation and more complex operations.
- A support agent is fed a poisoned retrieval document that instructs it to ignore refund policy and escalate to a privileged billing tool, changing tool use within the same session.
- A code assistant stores a false internal note about an API endpoint, then repeats the error in later sessions until the memory store is corrected.
- A customer-facing agent reads a malicious transcript fragment that causes it to reveal system prompts or follow attacker-controlled steps, a pattern discussed in the OWASP Top 10 for Agentic Applications 2026.
- An organisation discovers that persistent agent memory has absorbed stale access instructions from an offboarded workflow, making the agent continue to act on revoked assumptions.
- Post-incident review shows that a retrieved knowledge base article was altered, which shifted the agent’s response path without any obvious authentication failure.
These cases align with the broader NHI reality documented in the Ultimate Guide to NHIs, where persistent identity and secret exposure often become multipliers for abuse. The same principle applies to agent memory: once corrupted, it can quietly persist as operational “truth.”
Why It Matters in NHI Security
Context and memory poisoning matter because agent trust is often implicit. When an NHI can read documents, summarise conversations, retrieve stored facts, and invoke tools, poisoned inputs can steer it toward actions that appear legitimate. That makes detection difficult and post-incident attribution slow. For security teams, this is not only a model-safety issue; it is a governance issue tied to access scope, retrieval integrity, memory retention, and auditability. In environments with excessive NHI privileges, even a small poisoning event can cascade into broad misuse. NHIMG reports that 97% of NHIs carry excessive privileges, which means poisoned reasoning can quickly become privileged execution if controls are weak.
This risk also intersects with identity hygiene. If an agent stores bad assumptions about secret location, ownership, or approval state, the blast radius expands when those assumptions influence key rotation, escalation, or offboarding. The Ultimate Guide to NHIs is directly relevant because it connects visibility, lifecycle management, and zero-trust discipline to reducing this kind of abuse. Organisations typically encounter the operational cost only after an agent has made the wrong call at scale, at which point context and memory poisoning becomes impossible to ignore.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Covers agentic prompt and memory manipulation as core attack paths. |
| OWASP Non-Human Identity Top 10 | NHI-08 | Agent memory poisoning becomes an NHI governance issue when it alters privileged behaviour. |
| NIST AI RMF | Addresses trustworthy AI risks from malformed or manipulated inputs and retained state. | |
| NIST CSF 2.0 | PR.AC-1 | Access control discipline limits how poisoned context can reach sensitive actions. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust requires continuous verification of inputs, not implicit trust in session state. |
Add human review, logging, and monitoring for agent decisions influenced by stored or retrieved context.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
