What it is
Memory poisoning is the agent-era cousin of data poisoning. Where data poisoning corrupts what the model learns at training time, memory poisoning corrupts what the agent learns at runtime. An attacker has a single conversation in which they convince the agent of something false — "the customer always wants overnight shipping," "the refund cap was raised to $5,000," "ignore tickets containing the word 'urgent'." If the agent writes that to long-term memory, every future session inherits the lie. The attack is especially dangerous when memory is shared across users or agents on the same account, because one user's poisoning becomes everyone's truth.
Why it matters
Agent memory is one of the capabilities that makes agents feel useful, which is why teams are adding it quickly. But every memory write is a trust decision: you are saying "this fact is durable enough to influence future actions." Without scoping, validation, and audit, memory becomes a write-once attack surface that quietly degrades the agent for months. For shared organizational memory in particular, a single poisoned write can compromise an entire team's downstream decisions before anyone notices the agent's answers are wrong.
Key components
- Single-session poisoning — one conversation plants a fact that persists
- Cross-user contamination — memory shared between users carries the attack to others
- Long-tail activation — poisoned memory only triggers on rare future inputs, evading immediate detection
- Mitigation — scope, provenance, expiry, and review of memory writes
How it connects
In Agentforce, agents can store and retrieve facts across sessions using Data Cloud or custom memory objects in Salesforce — meaning a poisoned memory entry can silently shape case routing, quote generation, or customer responses long after the original conversation ends. Salesforce's agent trust controls and audit trail features are your first line of defense for reviewing what agents are actually writing to memory.
Good to know
Memory poisoning is hardest to catch because the agent behaves normally — it's just working from bad information. Treat unexplained shifts in agent behavior or outputs as a reason to audit recent memory writes, not just retrain the model.
Related terms
Agent Memory
The systems that let an AI agent retain context across calls, sessions, users, or teams — turning a stateless model into something with continuity. Encompasses short-term working memory, long-term episodic memory, and shared organizational memory.
Cascading Hallucinations
When one agent's hallucinated output is consumed as truth by the next agent in a workflow — quietly spreading bad data across systems and decisions before any human sees it.
Data Poisoning
Manipulating the data an AI model learns from — training sets, fine-tuning examples, or knowledge-base documents — so the resulting model is biased, broken, or contains hidden behaviors.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.
Threat Modeling (AI Agents)
A structured way to identify what could go wrong with an AI agent before it does — mapping attackers, attack surfaces, and impacts so you can build defenses in.
