Researchers have identified a critical vulnerability in AI agents that maintain memory across sessions. A study published in IEEE Access analyzed 2,614 multi-step attacks, revealing that slow-drift and backdoor-activation attacks can appear harmless for most of the task, triggering only in the final interactions. This makes traditional step-by-step prompt checks ineffective.
The study categorized four attack families: chain poisoning, policy rewriting, backdoor activation, and slow drift. These methods target the agent's long-term memory rather than the current prompt. Unverified input is recorded in long-sterm storage and later retrieved to influence planning or tool calls after a series of standard interactions.
A separate verification by Palo Alto Networks Unit 42 demonstrated this mechanism using indirect prompt injections in a configured Amazon Bedrock Agent. Malicious instructions were able to migrate from one session summary to the next. The researchers emphasize that this is a fundamental problem for all systems where unverified content can affect stored memory.
To mitigate these risks, developers are advised to test the entire sequence of recording, agent responses, and tool actions as a single unit. The study suggests implementing a record of the origin of stored memories and limiting which unverified input data can become part of the same context.
