Write Now, Fire Later: Memory Poisoning and the Audit Gap in Persistent AI Agents

Agents now remember. ChatGPT, Claude, Gemini, and Copilot all carry facts about their users from one conversation to the next, the major cloud platforms sell managed memory stores for enterprise agents, and coding agents load instruction files and skills from disk at the start of every session. Each of those stores is written during one session and read during another. That gap in time is the subject of this paper. An attacker who can get a single malicious record written today can have it act weeks later, in a session the attacker never touched, on behalf of a user who never saw the original input.

Research library