Memory and Context Poisoning — Planted content enters an agent's memory or retrieved context and shapes decisions long after it arrives.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
The lag is what makes it dangerous. Poisoned content lands on Monday and changes behaviour on Thursday, by which point the connection to the original document is invisible. Retrieval-heavy agents are the most exposed, because relevance ranking has no concept of trust.
Controls that address it
- Provenance on every memory write — where it came from, when, under what trust level.
- Segregate trusted and untrusted context; never let retrieved content occupy the same trust tier as operator instruction.
- Expire and decay memory rather than accumulating indefinitely.
- Treat all retrieved content as data, never as instruction, at the framework level.
- Replay to trace a decision back to the specific memory that shaped it.
The evidence that proves the control fired
A replay_job that reconstructs which context was present at decision time, plus provenance fields on the memory record.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Detection is weak across the industry. Provenance and replay make poisoning findable after the fact; they do not reliably prevent it. That is the current state of the art and pretending otherwise is the failure mode this list exists to name.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI05 Unexpected Code Execution ASI07 Insecure Inter-Agent Communication →
Common questions
What is ASI06 memory and context poisoning?
ASI06 memory and context poisoning — Persistent memory or retrieved context is contaminated, so the agent misbehaves long after the injection.
How do you defend against it?
Treat memory as untrusted input on every read, scope memory per principal, and make writes to long-term memory an auditable event rather than a side effect.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.