Memory Injection Attacks on LLM Agents via Query-Only Interaction

Modern memory modules automatically ingest and persist content without provenance verification.

“This is realistic because modern memory modules automatically ingest and persist content without provenance verification (Dong et al., 2025).”

Long-term memory can turn untrusted external content into persistent influence over an LLM agent's future decisions, creating the threat of indirect memory poisoning.

“Long-term memory can turn untrusted external content into persistent influence over an LLM agent's future decisions, creating the threat of indirect memory poisoning.”

A memory produced from the poisoning content may still be hidden by benign memories during retrieval.

“A memory produced from the poisoning content may still be hidden by benign memories during retrieval [2,6].”

MINJA shows that adversarial records can be implanted through normal user interactions.

“MINJA (Dong et al., 2025) further shows that adversarial records can be implanted through normal user interactions.”

MINJA achieves an average RSR@5 of 87.6% but only 48.2% AUR.

“MINJA achieves an average RSR@5 of 87.6% but only 48.2% AUR”

Reliance on memory introduces a security risk: adversaries can inject seemingly harmless records into an agent's memory to manipulate its future behavior.

“However, this reliance on memory introduces a critical security risk: an adversary can inject seemingly harmless records into an agent's memory to manipulate its future behavior.”

The indirect memory injection attack poisons memory through seemingly normal user queries and can initiate a self-reinforcing error cycle where flawed memories are used as precedents for future flawed actions.

“This attack vector is particularly dangerous as it poisons the memory through seemingly normal user queries, which can initiate a self-reinforcing error cycle where flawed memories are used as precedents for future flawed actions.”

Once triggered, memory injection can initiate a self-reinforcing error cycle: the corrupted outcome is stored as precedent, which amplifies the initial error and progressively lowers the threshold for similar attacks.

“Second, once triggered, the manipulation can initiate a self-reinforcing error cycle: the corrupted outcome is stored as precedent, which not only amplifies the initial error but also progressively lowers the threshold for similar attacks in the future.”

Recent work has demonstrated memory poisoning attacks in various settings.

“Recent work has demonstrated memory poisoning attacks in various settings (Dong et al., 2025; Srivastava & He, 2025; Anonymous, 2025; Chen et al., 2024; Zou et al., 2026; Xu et al., 2026).”