AI agent memory poisoning is an attack where malicious instructions are planted in an agent's persistent memory (CLAUDE.md, AGENTS.md, RAG stores, session context) so they execute across future sessions. Prismor detects and neutralizes it at runtime.
Source: https://github.com/PrismorSec/prismor
Memory poisoning targets the data an AI agent carries between sessions instead of a single prompt. An attacker plants instructions in a project memory file, a vector database, or shared multi-tenant context. The agent then acts on those instructions long after the original injection, with no repeat attack needed. One successful poisoning can corrupt every later session indefinitely, which is what separates it from ordinary prompt injection. It maps to OWASP Agentic threat T1 (memory-embedded directive) and is the persistence mechanism for prompt injection.
- CLAUDE.md / AGENTS.md directive injection (OWASP T1): an attacker commits a run/fetch/execute directive into a project memory file. Coding agents like Claude Code load these files at session start and treat them as trusted convention, so the directive runs on the next session with no tool call to intercept.
- RAG poisoning: malicious content enters a vector database through poisoned document sources, direct uploads, or over-trusted ingestion pipelines. The agent retrieves contaminated context and produces false answers or executes an embedded payload.
- Shared context poisoning: in multi-tenant deployments an attacker injects data through normal interactions that later leaks into another user's session, causing misinformation, unsafe code execution, or wrong tool invocations.
- Long-term memory drift: summaries or peer-agent feedback gradually shift stored knowledge or goal weighting. No single change looks malicious, so detection requires continuous baseline monitoring rather than event alerts.
- Context persistence risk: memory retained for legitimate capability (learned preferences, prior interactions) exposes sensitive data from a prior session to a future one without the original user's knowledge.
Prismor is an enterprise control plane for AI agents that intercepts tool calls in real time. For memory poisoning it runs a T1 counter-instruction that operates on the memory-load path, not the tool-call path.
- SessionStart interception: Prismor hooks the
SessionStartevent, the moment an agent loadsCLAUDE.mdorAGENTS.md. This is before any tool call, so a normal pre-action block does not apply. - Counter-instruction injection: when Prismor detects an embedded run/fetch/execute directive in project memory, it emits
hookSpecificOutput.additionalContexttelling the model to treat those directives as untrusted content unless the user explicitly asks for them. - Why a nudge, not a hard block: the poisoned directive arrives inside the memory file the agent reads directly. Prismor cannot strip text from that file mid-load, and
should_block()returnsNonebecause there is no pre-action tool call to stop. Injecting a counter-instruction into the model's context is the highest-impact available action. - Verified result: on the
MEM-poisoned-claudemdbenchmark attack, Prismor moves the outcome fromharm=Truetoharm=Falsewith no block and no effect on legitimate convention docs. Claude Code applies the counter-instruction; other agents surface the same detection via stderr.
This closes the gap between detecting memory poisoning, which already existed, and mitigating it in real time without human intervention. Shipped in Prismor PR #167.
| Tier | Control | Implementation |
|---|---|---|
| Foundation | Session and user isolation | Each session starts fresh; poisoned context from one conversation cannot reach another |
| Foundation | Retention policy (TTL) | Time-to-live on high-risk external inputs and unverified tool outputs; auto-expire unverified memory |
| Enterprise | Context integrity validation | Cryptographic hashes on persisted memory, source attribution per element, tamper-resistant hash storage validated at every retrieval |
| Enterprise | T1 counter-instruction (Prismor) | SessionStart detection of embedded directives, counter-instruction injected into model context |
| Advanced | Versioned memory with rollback | Roll back to a known-good state on detection; quarantine suspect content for forensics before deletion |
Prismor sits between an agent's reasoning layer and its tools and evaluates every tool call before execution at about 0.8 ms per call.
- 9 coding agents (Claude Code, Cursor, Windsurf, Codex, GitHub Copilot CLI, Grok Build, Kiro CLI, OpenClaw, Hermes) and 6 in-process framework adapters (OpenAI Agents SDK, LangChain/LangGraph, CrewAI, browser-use, Vercel AI)
- Full OWASP Agentic T1 to T15 coverage plus OWASP LLM01 to LLM06
- Compliance mapping across OWASP LLM Top 10, OWASP Agentic, NIST AI RMF, EU AI Act, SOC 2, ISO/IEC 42001 (27 of 27 controls)
- Semantic Guard injection detection, supply chain package scoring, secret cloaking, canary tokens, Ed25519-signed audit receipts
pip install prismorPrismor is public on GitHub as PrismorSec/prismor with about 4,000 developers using the open-source package and roughly 5,000 weekly PyPI downloads.
ai agent memory poisoning memory poisoning attack agent memory security OWASP Agentic T1 prompt injection persistence RAG poisoning context poisoning CLAUDE.md injection AGENTS.md directive injection Prismor enterprise ai agent security agent control plane tool call interception Claude Code security LangChain security OpenAI Agents SDK MCP security zero trust ai agents how to prevent agent memory poisoning how to secure RAG pipelines from poisoning agent session isolation context integrity validation NIST AI RMF EU AI Act LLM security