{"id":"memory-poisoning-as-attack-surface--simonwillison-net","name":"Memory Poisoning as Attack Surface","url":"https://simonwillison.net/2025/Sep/18/agents/","page":"https://mrpeppersdev.github.io/agent-infrastructure-landscape/systems/memory-poisoning-as-attack-surface--simonwillison-net","family":"memory-research","section":"Theoretical / informal — ideas without a paper","sections":["Theoretical / informal — ideas without a paper"],"tier":5,"last_verified_at":"2026-10-23","lifecycle":{"status":"active","severity":0,"note":null},"taxonomy":{"storage":[{"value":"n/a","primary":true,"reason":"n/a — not applicable — security framing"}],"retrieval":[{"value":"agentic","primary":true,"reason":"agentic — long-term memory is 'an extra set of tools'"}],"persistence":[{"value":"long-term","primary":true,"reason":"long-term — poisoned long-term store"}],"update":[{"value":"agent-controlled","primary":true,"reason":"agent-controlled — adversarial document instructs the agent's memory tool to write facts"}],"unit":[{"value":"fact","primary":true,"reason":null},{"value":"attack","primary":false,"reason":null}],"governance":[{"value":"n/a","primary":true,"reason":"n/a — not applicable — security framing"}],"conflict":[{"value":"out-of-scope","primary":true,"reason":"out-of-scope — theoretical framing, no implementation"}]},"cells":{"type":{"value":"Security framing","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"desc":{"value":"Agent persistent memory is an attack surface: an adversarial document in the environment can instruct the agent's memory tool to write malicious facts, poisoning the long-term store. The more capable the memory system, the larger the injection surface. Conversation history is memory's first-class form; long-term memory is \"an extra set of tools.\"","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"claims":{"value":"Simon Willison (creator of Datasette, coined \"prompt injection\"), Sept 2025 + ongoing series.","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"modalities":{"value":"text","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"created":{"value":"2024 (AgentPoison NeurIPS 2024; Lakera blog Nov 2025; concept crystallised 2024 with AgentPoison paper)","citation":"https://proceedings.neurips.cc/paper_files/paper/2024/file/eb113910e9c3f6242541c1652e30dfd6-Paper-Conference.pdf","status":"real-data","tier":"T2","last_verified_at":"2026-05-12","source_class":"paper"},"latest-release":{"value":"not applicable — not OSS","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-12"},"license":{"value":"not applicable — not OSS","citation":null,"status":"not-applicable","tier":"T3"},"gh":{"value":"not applicable — no GitHub repo","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-12"},"mindshare":{"value":"searched not found","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"depth-floor-reached","tier":"T2","last_verified_at":"2026-05-12","source_class":"vendor"},"citations":{"value":"not applicable — informal blog/tweet/gist; not indexed on Semantic Scholar","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","last_verified_at":"2026-05-12","source_class":"vendor"},"funding":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-12"},"customers":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"pricing":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"compliance":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"data-handling":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"deployment":{"value":"not applicable — not a deployable product","citation":null,"status":"not-applicable","tier":"T3"},"hq":{"value":"not applicable — not a company","citation":null,"status":"not-applicable","tier":"T3"},"founders":{"value":"Simon Willison (independent developer and co-creator of Django; founder of Datasette)","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"volume":{"value":"not applicable — not a memory product","citation":null,"status":"not-applicable","tier":"T3"},"perf":{"value":"not applicable — does not compete on benchmarks","citation":null,"status":"not-applicable","tier":"T3"},"repro":{"value":"not applicable — not a research paper","citation":null,"status":"not-applicable","tier":"T3"},"code-release":{"value":"not applicable — not a research paper","citation":null,"status":"not-applicable","tier":"T3"},"api-surface":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"latency":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"throughput":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"backend-storage":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"multi-tenancy":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"encryption":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"sso-rbac":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"embedding-model":{"value":"not applicable — theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"consistency":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"versioning":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"tombstoning":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"schema-evolution":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"namespace":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"contradiction":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"forgetting":{"value":"not applicable - theoretical concept, no implementation","citation":null,"status":"not-applicable","tier":"T3"},"mcp-support":{"value":"not applicable — theoretical / informal idea","citation":null,"status":"not-applicable","tier":"T3"},"a2a-support":{"value":"not applicable — theoretical / informal idea","citation":null,"status":"not-applicable","tier":"T3"},"otel":{"value":"not applicable — theoretical / informal idea","citation":null,"status":"not-applicable","tier":"T3"},"webhooks":{"value":"not applicable — theoretical / informal idea","citation":null,"status":"not-applicable","tier":"T3"},"import-export":{"value":"not applicable — theoretical / informal idea","citation":null,"status":"not-applicable","tier":"T3"},"integration-count":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"orchestration":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"programmatic-control":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"vendor-benchmarks":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-12"},"pricing-specifics":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"agent-abstraction":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"memory-primitives":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"llm-lock":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"runtimes":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"session-handling":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"validated-verticals":{"value":"not applicable - theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"time-to-running":{"value":"not applicable - theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"anti-fit":{"value":"not applicable - theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"optimised-for":{"value":"not applicable - theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"adjacent-infrastructure":{"value":"not applicable - theoretical / not a system","citation":null,"status":"not-applicable","tier":"T3"},"pros":{"value":"Frames agent persistent memory as a first-class attack surface; widely cited by security practitioners; ongoing series.","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"cons":{"value":"Blog framing; provides analysis but does not specify concrete countermeasures.","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"links":{"value":"agents post prompt-injection series","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"real-data","tier":"T2","source_class":"vendor"},"obs-langsmith":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-opentelemetry":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-datadog":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-helicone":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-weave":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-langfuse":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-arize":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-custom":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-token-budget":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-prompt-caching":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-semantic-caching":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-batching":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-model-routing":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-streaming-only":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-observability-cost-attribution":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-langsmith-evals":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-braintrust":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-weights-and-biases-agent":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-helicone-evals":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-custom-test-harness":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-human-loop":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-production-traffic-replay":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"commit-trajectory":{"value":"not applicable — no GitHub repo","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-14"},"citation-trajectory":{"value":"not applicable — non-paper row","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-14"},"download-trajectory":{"value":"not applicable — not published as a package","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-14"},"cost-input-usd-per-mtok":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"cost-output-usd-per-mtok":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"cost-tier":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"cost-pricing-model":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"cost-last-verified":{"value":"not applicable — not commercial","citation":null,"status":"not-applicable","tier":"T3"},"capability-composite-score":{"value":"not applicable — security framing / blog series, not a runnable system","citation":null,"status":"not-applicable","tier":"T3"},"capability-band":{"value":"not applicable — security framing / blog series, not a runnable system","citation":null,"status":"not-applicable","tier":"T3"},"capability-benchmark-sources":{"value":"not applicable — security framing / blog series, not a runnable system","citation":null,"status":"not-applicable","tier":"T3"},"capability-last-verified":{"value":"not applicable — security framing / blog series, not a runnable system","citation":null,"status":"not-applicable","tier":"T3"},"use-case-tags":{"value":"not applicable — security framing essay, no deployable system","citation":null,"status":"not-applicable","tier":"T3"},"use-case-anti-tags":{"value":"not applicable — security framing essay, no deployable system","citation":null,"status":"not-applicable","tier":"T3"},"adoption-accelerator":{"value":"","citation":null,"status":"no-data","tier":"T3"},"architecture-deployment-locus":{"value":"","citation":null,"status":"no-data","tier":"T3"},"licensing-bucket":{"value":"not applicable — research paper","citation":"https://simonwillison.net/2025/Sep/18/agents/","status":"not-applicable","tier":"T2","source_class":"vendor"},"positioning-platform-vs-product":{"value":"","citation":null,"status":"no-data","tier":"T3"},"taxonomy-three-layer-rollup":{"value":"agent-infra","citation":"https://github.com/MrPeppersDev/agent-infrastructure-landscape/blob/main/docs/schema/section-to-three-layer-rollup.json","status":"real-data","tier":"T1","source_class":"repo"},"developer-activity-opendigger":{"value":"","citation":null,"status":"no-data","tier":"T3"},"freshness-date":{"value":"2026-10-23","citation":"https://mrpeppersdev.github.io/agent-infrastructure-landscape/systems/memory-poisoning-as-attack-surface--simonwillison-net","status":"real-data","tier":"T2","source_class":"catalog"},"compliance-certifications":{"value":"","citation":null,"status":"no-data","tier":"T3"},"sdk-languages":{"value":"","citation":null,"status":"no-data","tier":"T3"},"protocol-support":{"value":"","citation":null,"status":"no-data","tier":"T3"},"maturity":{"value":"","citation":null,"status":"no-data","tier":"T3"}},"corroboration":{"cited_cells":11,"third_party_cells":0},"edges":{"outgoing":[],"incoming":[]},"history":[],"license":"CC-BY-4.0","source":"https://github.com/MrPeppersDev/agent-infrastructure-landscape/blob/main/data/landscape.json"}