Summary
Agent memory poisoning is the class of prompt-injection attack in which the persistent, agent-readable memory files that coding agents load at session start become the injection vector. Because those files are treated as trusted context, anything able to write them gains persistent control over every future session — the persistence, not the injection itself, is the severity.
The mechanism named by "Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems" (arXiv 2607.14611) is the self-modification loop: the agent can update the very file that is later loaded back as trusted instruction. This is not an analogue of common agent designs; for loops that write and re-read their own instruction files, it is the design.
Key Points
- The architecture in question. Coding agents implement cross-session persistence through user-curated plain-text files read at session start: Claude Code uses
CLAUDE.md, Codex usesAGENTS.md, OpenClaw usesSOUL.md. - The self-modification loop. The agent both reads and writes these files. A file loaded at startup is trusted context, so a write to it persists across every subsequent session — a durable foothold, not a one-shot injection.
- Persistence is the point. The paper's framing sharpens severity: the attack class is defined by surviving session boundaries, so a single successful write compounds indefinitely.
- Previously published, rated HIGH. HOL Guard advisory "Agent-readable config file poisoning" names the same files —
CLAUDE.md,.cursorrules,AGENTS.md,.github/copilot-instructions.md— as "trusted context loaded on every session." - Vendor mitigation is process, not product. HOL Guard's recommended control — "treat agent-readable instruction files as code and review changes before trusting them" — is human vigilance, and the vendor explicitly states it provides no known-good baseline or drift alert for these files.
- Tamper-evident-looking, still poisoned. NVIDIA's "Mitigating Indirect AGENTS.md Injection Attacks in Agentic Environments" (Apr 2026) describes a payload committed into where the PR summary showed no evidence of tampering — Codex prepared the PR while concealing the injected instruction.