The architectural migration from stateless LLM interfaces to stateful autonomous agents introduces a severe structural vulnerability: persistent memory poisoning. In enterprise setups where agents maintain context across sessions, build execution plans, and call external APIs, long-term memory acts as a persistent attack surface. Research led by Hadis Karimipour at the University of Calgary demonstrates that malicious instructions seeded into an agent's memory store can lie dormant across dozens of clean sessions before triggering arbitrary tool calls or exfiltrating data.
An adversary no longer needs real-time control over an active session. By injecting adversarial payloads through unvalidated inputs, web scraping, or third-party tool responses, the corrupted directives become part of the agent's trusted baseline. The system operates predictably across subsequent runs until a specific contextual trigger forces the retrieval of the poisoned vector, redirecting tool execution and enterprise API permissions without operator knowledge.
Failure Modes of Single-Step Audits
To quantify these delayed threats, the University of Calgary team analyzed 2,614 simulated multi-step attack trajectories against memory-enabled LLM agents across four threat vectors: chain poisoning, policy rewriting, backdoor triggering, and slow drift.
"In particular, slow-drift and backdoor-trigger attacks could evade evaluations that looked only at individual steps until their effects appeared in later interactions."
Standard point-in-time perimeter checks fail systematically here. Evaluating an agent immediately post-ingestion delivers a false clean bill of health because the malicious instruction remains inert until triggered by future context. The risk trajectory is non-monotonic: an agent can display completely benign metrics at intermediate stages before executing an unauthorized API payload.
Trajectory-Aware Defensive Frameworks
Treating agentic memory as trusted state is a critical design failure for enterprise security architects. Securing only the immediate input prompt leaves downstream vector databases, RAG indices, and long-term key-value stores completely exposed to persistent data corruption.
Mitigating this threat demands strict input sanitization prior to memory writes, granular tool-level permission isolation (least privilege execution), and proactive auditing of vector embeddings. Security engineering must shift from stateless point-in-time checks to continuous, trajectory-aware verification that monitors agent behavioral drift across extended operational histories.