Agent memory poisoning turns persistence into a security boundary

Agent memory is supposed to make AI feel useful instead of forgetful. The security problem is that memory can also preserve the wrong thing. If an attacker can poison what an agent remembers, a one-time interaction can become a durable vulnerability that follows the system into future work.

That changes how teams should think about agent design. Prompt injection was already a problem inside a single session; persistent memory turns it into a state-management and provenance problem. The agent needs to know not only what it remembers, but where the memory came from and whether it should still be trusted.

Developers should treat memory as a permissioned datastore, not a convenience feature. Review controls, expiry, source labels, and sandboxing will matter more as agents gain access to repositories, browsers, documents, and customer systems.