title: Agent Memory Manipulation
id: ATR-2026-00075
rule_version: 1
status: experimental
description: |
  Detects attempts to poison or manipulate an agent's persistent memory, long-term context, or state storage. Attackers inject commands that instruct the agent to remember false information, update its own instructions, or modify its persistent behavior across sessions. Successful memory poisoning can establish persistent backdoors that survive context resets and affect all future interactions.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
    - LLM02:2025
  owasp_agentic:
    - ASI06:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
    - AML.T0080 - AI Agent Context Poisoning
  mitre_attack:
    - 'T1565.001 - Data Manipulation: Stored Data Manipulation'
compliance:
  eu_ai_act:
    - article: '14'
      context: Agent memory poisoning corrupts persistent context across sessions, allowing attackers to establish behavioral backdoors that survive individual-turn oversight checks; Article 14 requires that human oversight mechanisms remain effective across the full lifecycle of agent interactions, including persistent state.
      strength: primary
    - article: '15'
      context: Article 15 robustness requirements mandate resistance against adversarial inputs that modify system behavior; memory injection attacks that alter an agent's long-term behavioral state represent a critical robustness failure requiring detection controls.
      strength: secondary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Agent Memory Manipulation) affecting that data.
      strength: secondary
  nist_ai_rmf:
    - subcategory: GV.1.2
      context: Memory manipulation attacks that inject false behavioral directives require clearly assigned accountability roles to ensure that persistent agent state is monitored and that any unauthorized modification is escalated to a responsible party.
      strength: primary
    - subcategory: MG.2.3
      context: Risk treatment plans for memory poisoning must include controls that detect and block cross-session behavioral injection before poisoned directives propagate into future interactions.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Agent Memory Manipulation).
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Agent Memory Manipulation).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: AI objectives and risk treatment plans must explicitly address memory manipulation threats to prevent attackers from establishing persistent behavioral backdoors that survive context resets.
      strength: primary
    - clause: '8.1'
      context: Operational controls for AI systems must include integrity checks on persistent memory stores to ensure that agent behavioral state has not been tampered with between sessions.
      strength: secondary
tags:
  category: context-exfiltration
  subcategory: memory-manipulation
  scan_target: mcp
  confidence: high
agent_source:
  type: memory_access
  framework:
    - langchain
    - autogen
    - crewai
    - any
  provider:
    - any
detection:
  conditions:
    - field: user_input
      operator: regex
      value: (?i)(remember\s+that|commit\s+to\s+memory|store\s+(this|the\s+following)\s+(in|to)\s+(your\s+)?memory|save\s+(this|the\s+following)\s+(to|in)\s+(your\s+)?(long[\s-]?term\s+)?memory)\s*[:;-]?\s*(you\s+(are|must|should|will)|from\s+now|always|never|ignore|override|your\s+(new|real|true|actual))
      description: Memory injection with behavioral modification directives
    - field: user_input
      operator: regex
      value: (?i)(update|modify|change|replace|overwrite|edit)\s+(your|the\s+agent'?s?)\s+(instructions?|rules?|guidelines?|directives?|system\s+prompt|core\s+(values?|behavior|programming)|personality|persona)
      description: Direct instruction modification attempts via memory update
    - field: user_input
      operator: regex
      value: (?i)(from\s+now\s+on|going\s+forward|in\s+(all\s+)?future\s+(conversations?|sessions?|interactions?)|permanently|forever|across\s+(all\s+)?sessions?),?\s+(always|never|you\s+(must|should|will))\s+\w+
      description: Cross-session persistent behavior modification attempts
    - field: user_input
      operator: regex
      value: (?i)(add|write|insert|inject|append)\s+(this|the\s+following)?\s*(to|into)\s+(your\s+)?(permanent|persistent|long[\s-]?term|core)\s+(memory|storage|state|context|knowledge)
      description: Direct persistent memory write injection attempts
    - field: user_input
      operator: regex
      value: (?i)(your\s+(true|real|actual|original|hidden)\s+(purpose|goal|objective|mission|identity)\s+(is|was|has\s+always\s+been)|you\s+were\s+(actually|really|truly|originally)\s+(designed|built|created|programmed)\s+to)
      description: Identity manipulation through false origin claims
    - field: user_input
      operator: regex
      value: (?i)(forget|delete|erase|remove|clear|purge)\s+(all\s+)?(your\s+)?(safety|security|ethical|content)\s+(rules?|guidelines?|filters?|constraints?|guardrails?|training|restrictions?)\s+(from\s+(your\s+)?memory)?
      description: Attempts to erase safety constraints from agent memory
  condition: any
  false_positives:
    - Users legitimately asking an agent with memory features to remember preferences
    - Developers configuring agent behavior through documented memory APIs
    - Users asking to update conversation context with factual corrections
    - A developer writing documentation that describes how to update the agent's guidelines through an official admin API endpoint
    - A user asking the agent to save their delivery address to long-term memory for future orders without any behavioral modification directives
response:
  actions:
    - block_input
    - alert
    - snapshot
    - reset_context
    - escalate
  auto_response_threshold: high
  message_template: |
    [ATR-2026-075] Agent memory manipulation detected. Input contains patterns consistent with an attempt to poison the agent's persistent memory or modify its behavioral directives across sessions. Input blocked and context state preserved for forensic review.
confidence: 73
wild_validated: 2026/04/08
wild_samples: 53577