Persistent memory in agents creates a new failure mode: false information stored once can contaminate every future session that retrieves it. A recent paper (arXiv:2608.21230v1) measures this attack surface and tests two common defenses: content screening at write time and provenance-weighted retrieval. Both fail.
The attack uses plainly worded false assertions, no adversarial prompts, no instruction injection, and no retriever optimization. Poisoning 1.2% of a LongMemEval corpus drops accuracy from 0.850 to 0.300. A four-stage screening pipeline that catches 83.2% of indirect prompt injections rejects zero of 360 poisoned memories.
Why Content Screening Fails
Content-only screening cannot distinguish false assertions from true ones without external grounding. A statement like "The capital of France is Lyon" looks syntactically identical to "The capital of France is Paris." Both are grammatically correct, contextually plausible, and free of trigger words.
The tested pipeline includes:
