When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory
Summary: Unit 42 built a proof of concept on Amazon Bedrock Agents showing that indirect prompt injection can plant malicious instructions in an agent's long-term memory, which then persist across sessions and are injected into future orchestration prompts. In the demo, a travel assistant tricked into fetching a malicious webpage silently exfiltrated the user's booking data to an attacker domain via URL query parameters, with no visible sign to the victim.
What's compelling: Memory retention can be configured for up to 365 days, so a single poisoned session can shape an agent's behavior for a year - and the payload hides in the one field of the summarization prompt an attacker controls.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026