Three of 11 catalogued attacks on agent memory and learning reached production systems

All of these attacks depend on state that survives the session. A stateless model forgets an attack when the session ends. A model that remembers or learns does not ^[1]. Anything that lands in memory comes back in later sessions as context the agent treats as its own. The CyberXDefend post calls the result "one bad write, exploited forever" ^[15].

According to the post, persistence is why OWASP separates Memory and Context Poisoning, ASI06 in its Top 10 for Agentic Applications, from ordinary prompt injection ^[2]. The author wrote that he had not opened the OWASP primary and worked from a secondary summary published by Akto ^[3].

In the memory cases, the payload arrives through content the agent reads. Rehberger's instructions sat in documents and web pages ^[4]. MemoryGraft used harmless-looking content such as a README. Weeks later the agent retrieved the poisoned "successful experience" and copied it ^[7]. eTAMP, in April 2026, showed cross-session, cross-site compromise with no direct access to the memory at all ^[8].

OpenAI's fix covered the exit. It patched the exfiltration path in Rehberger's attack, and the post says OpenAI acknowledged that prompt injection that manipulates memory storage is still an open problem ^[5]. Radware's ZombieAgent went back through memory against the same product in January 2026 ^[6].

The record shows these attacks working on production systems; it does not show criminals using them. Of about 11 named attacks or studies, three ran against production systems and the rest are research demos ^[13], roughly eight ^[1]. The author found no confirmed criminal campaign in the wild. He argued that with attacks built to stay dormant for weeks, absence of evidence is not reassuring ^[14]. An IEEE Access study supports the dormancy point. Across 2,614 multi-step attack trajectories, some poisoning stayed indistinguishable from normal behavior until much later interactions ^[11].

The research figures describe the researchers' setups. MemMorph's 85.9% is a ceiling from a research demo, reached with three planted records posing as technical facts and policies ^[10][13]. I'd expect it to transfer to an agent that feeds unvetted retrieved records straight into tool selection. It should transfer less well where each record carries provenance the agent checks before acting. P-Trojan's persistence figure was measured on Qwen2.5 and LLaMA3 ^[12]. A team fine-tuning a different base model would need to reproduce it before planning around it.

The post closes with a design review of Ontogen, a project aimed at skill learning through use ^[18]. Its feedback(decision_id, outcome) call is an attack surface. An attacker who can fake outcomes can train the decision head, which is the MemMorph pattern written into slow traces instead of text ^[16]. The author credits the design with per-user regions, age-indexed rollback and a surprise gate ^[17]. I think age-indexed rollback matters most of the three. Poisoning that stays quiet for weeks ^[11] can only be undone by returning state to a point before the bad write. That requires knowing when each write happened.