Threat dossier · P2
Memory and context poisoning
Persistent state can amplify one poisoned interaction across future sessions, plans, tools, and delegated work.
Direct answer
What is memory and context poisoning?
Memory poisoning stores attacker-controlled or incorrect context so it can influence later agent decisions after the original malicious input is gone.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
Untrusted content reaches a writeable memory/context mechanism.
Step 2
Poisoned state is retained.
Step 3
A later task retrieves the poisoned state as trusted context.
Step 4
The future plan or tool action changes.
Coverage boundary
What this control can cover
- Consequential supported actions influenced by retrieved memory can still be evaluated at action boundaries.
- Evidence pages can preserve the distinction between context risk and runtime enforcement.
What it does not prove or prevent
- Universal inspection or sanitization of every third-party memory store.
- Proof that retained natural-language memory is semantically correct.
Policy pattern
Policy pattern for memory and context poisoning
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: Persistent state can amplify one poisoned interaction across future sessions, plans, tools, and delegated work.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Universal inspection or sanitization of every third-party memory store.
- Proof that retained natural-language memory is semantically correct.
If you suspect prompt injection
Step 1
Response 1
Quarantine affected memory/state.
Step 2
Response 2
Trace the write source and downstream reads.
Step 3
Response 3
Rebuild from verified context where possible.
Step 4
Response 4
Retest downstream actions after cleanup.