Your prompts can be weaponized through memory — here's how to defend against it

Most people think about prompt injection as a live-session attack. But there's a more persistent variant: memory poisoning.

If your agent uses RAG, vector stores, or persistent conversation history, an attacker can plant adversarial content that gets retrieved in future sessions. The poisoned memory can override your system prompt, exfiltrate data through tool calls, or subtly manipulate agent behavior — and it persists because the memory does.

OWASP recently added this as ASI06 in their new Top 10 for Agentic Applications. We built an open-source middleware called Agent Memory Guard that screens every memory read/write for:

- Instruction override attempts ("ignore previous instructions...")

- Data exfiltration patterns (tool calls that leak sensitive data)

- Tool hijacking (unauthorized tool invocations)

- Social engineering (manipulating the agent's persona)

It uses SHA-256 integrity baselines + pattern detection + YAML policy enforcement. Zero dependencies, no API keys, runs locally with sub-100μs latency.

GitHub: https://github.com/OWASP/www-project-agent-memory-guard

Curious if anyone else has encountered memory poisoning in production. How are you handling it?