AI Memory Poisoning Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: July 30, 2026 | License: CC BY 4.0
Quick Answer
Research published between 2024 and mid-2026 documents AI memory poisoning attack success rates ranging from 32.5% against production AI browsers (eTAMP, April 2026) to 98.2% injection success against memory-augmented LLM agents (MINJA, NeurIPS 2025). OWASP formally classified this threat as ASI06 — Memory & Context Poisoning — in its 2026 Agentic AI Top 10, the first peer-reviewed security framework built specifically for autonomous AI systems.
Key Findings
- MINJA (NeurIPS 2025) achieved a 98.2% injection success rate and a 70% attack success rate against memory-augmented LLM agents using query-only interaction, requiring no elevated privileges or direct memory store access — the attack reaches production systems through normal user queries.
- PoisonedRAG (USENIX Security 2025, arXiv:2402.07867) achieved 91–99% attack success rates against RAG systems with PaLM 2 in black-box settings by injecting just five malicious documents into databases containing millions of entries.
- Agent Security Bench (ICLR 2025, arXiv:2410.02644), which tested 27 attack and defense combinations across 400+ tools and 13 LLM architectures with nearly 90,000 test cases, found a peak average attack success rate of 84.30% — and found current defenses to be of limited effectiveness.
- eTAMP (arXiv:2604.02623, April 2026) demonstrated cross-session, cross-site memory poisoning against production AI browsers including ChatGPT Atlas and Perplexity Comet, achieving up to 32.5% attack success without any direct memory access, and up to an 8× increase in that rate when agents encountered UI friction.
- Axis Intelligence Research’s Persistence-Weighted Attack Severity Index (PWASI) — the first composite ranking of memory poisoning threats by injection rate, attack success rate, persistence duration, and privilege required — scores PoisonedRAG at 98.2/100, MINJA at 88.8/100, and AgentPoison at 82.8/100, with eTAMP at 49.4/100 reflecting lower ASR but full cross-site persistence.
What Is AI Memory Poisoning?
AI memory poisoning is the injection of malicious content into an AI agent’s persistent memory — its vector store, RAG knowledge base, episodic log, or context window — such that the corrupted entry shapes the agent’s behavior across future sessions, long after the initial attack. The distinction from prompt injection is structural: prompt injection resets when the conversation ends; memory poisoning does not.
OWASP’s GenAI Security Project captured the structural difference plainly in its May 2026 blog post on ASI06: agentic systems do not just respond in the moment — they retain context, reuse memory, and rely on persistent state to guide future reasoning and actions. What makes them useful is precisely what makes them vulnerable. OWASP listed Memory & Context Poisoning as ASI06 in its Top 10 for Agentic Applications 2026, a framework developed with input from over 100 security experts and explicitly endorsed by organizations including NIST, Microsoft, and NVIDIA.
The attack and its effect are temporally decoupled. An adversary writes a poisoned memory entry today; the compromised behavior surfaces when an unrelated user query triggers that entry weeks later. The entry persists until it is manually detected and removed — which requires visibility that most production deployments do not yet have.
How High Are Attack Success Rates?
MINJA: 98.2% Injection Success With Zero Privileges
The most practically dangerous finding in the 2024–2026 research record comes from MINJA — Memory INJection Attack — published at NeurIPS 2025 by Dong et al. (arXiv:2503.03704). MINJA demonstrates that an adversary can inject malicious records into an agent’s memory bank through query-only interaction: no access to the memory store, no elevated privileges, no model fine-tuning. The attacker is simply a regular user asking carefully shaped questions.
Across all tested agents and datasets, MINJA achieved an injection success rate exceeding 98%. The attack success rate — the proportion of cases where injected entries actually caused the agent to produce attacker-chosen outputs — exceeded 70% on most datasets. A follow-on study confirmed these rates generalize to GPT-4o-mini, Gemini-2.0-Flash, and Llama-3.1-8B. Benign utility degradation remained below 2% on most datasets, meaning the attack runs silently against a system that continues to appear functional.
The mechanism relies on three stages MINJA formalizes: bridging steps that construct plausible intermediate reasoning leading toward the adversarial target; indication prompts that induce the agent to generate those bridging steps autonomously; and progressive shortening that gradually removes the indication prompt so the poisoned record is self-sustaining once stored.
Marcus Chen: The 98.2% injection rate is the number that should end the “this is theoretical” framing. MINJA doesn’t need a credential, a vulnerability, or an open port. It needs a query interface and enough patience to construct the right questions. Every enterprise running an LLM agent with a memory store has that interface exposed to at least its internal users.
AgentPoison: 80%+ Success at Under 0.1% Poison Rate
AgentPoison, published at NeurIPS 2024 by Chen et al. (arXiv:2407.12784), targets the RAG-based memory stores that enterprise agents rely on for long-term knowledge. The paper tested three distinct agent types: an autonomous driving agent, a knowledge-intensive QA agent, and a healthcare EHRAgent. Across all three, AgentPoison achieved an average attack success rate exceeding 80%, with less than 1% degradation in benign performance and a poison rate below 0.1%.
The 0.1% figure is the part that resists casual absorption. In a vector database containing 100,000 embedded chunks — a conservative enterprise deployment — fewer than 100 malicious documents suffice to reliably redirect the agent whenever a target keyword appears. The attack requires no model retraining; the optimized backdoor trigger exhibits strong transferability across different RAG embedding architectures.
PoisonedRAG: 91–99% in Black-Box Settings
PoisonedRAG, published at USENIX Security 2025 by Zou et al. (arXiv:2402.07867), formalizes knowledge corruption attacks on RAG systems. In black-box settings against PaLM 2, the attack achieved 97% on the NQ dataset, 99% on HotpotQA, and 91% on MS-MARCO — injecting just five malicious texts into databases of millions. F1 scores for retrieval success exceeded 0.98 across configurations, confirming that the malicious documents are reliably surfaced when target queries appear.
eTAMP: Cross-Site Persistence Without Direct Memory Access
The most operationally significant 2026 research is the eTAMP paper (arXiv:2604.02623, April 2026), whose framing — “Poison Once, Exploit Forever” — accurately describes the threat model. eTAMP introduces Environment-injected Trajectory-based Agent Memory Poisoning, the first attack demonstrating cross-session, cross-site compromise without any direct memory access.
The attack mechanism: a user visits a single manipulated product page. That page injects adversarial content into the AI browser agent’s trajectory memory — its record of what it did during the browsing session. In all future sessions on completely different websites, the poisoned entry activates, altering the agent’s behavior on sites it has never visited before. Permission-based defenses — which block agent actions on known-malicious sites — do not prevent the attack, because the malicious site only needs to be visited once.
Against GPT-5-mini, attack success rates reached 32.5%. Against GPT-5.2 and GPT-OSS-120B, they reached 23.4% and 19.5% respectively. More capable models showed no meaningful security advantage: GPT-5.2 demonstrated substantial vulnerability despite superior task performance. Under UI friction conditions — dropped clicks, garbled text — the attack success rate increased by up to 8× due to what eTAMP terms “Frustration Exploitation,” a condition where agents under environmental stress become dramatically more susceptible.
| Attack | Paper | Venue | ISR | ASR | Memory Type | Privileges Required |
|---|---|---|---|---|---|---|
| MINJA | arXiv:2503.03704 | NeurIPS 2025 | 98.2% | 70%+ | Episodic / long-term | None (query-only) |
| AgentPoison | arXiv:2407.12784 | NeurIPS 2024 | 82% (retrieval) | 80%+ | RAG / long-term | Trigger optimization |
| PoisonedRAG | arXiv:2402.07867 | USENIX Sec 2025 | 98% (F1) | 91–99% | RAG knowledge base | None (document injection) |
| eTAMP | arXiv:2604.02623 | Preprint 2026 | N/A | 19.5–32.5% | Trajectory / browser | None (environmental) |
| ASB (Mixed) | arXiv:2410.02644 | ICLR 2025 | — | 84.30% peak | All agent stages | Varies |
Source column: arXiv and conference proceedings as cited. ISR = Injection Success Rate. ASR = Attack Success Rate.
Axis Intelligence Research: Persistence-Weighted Attack Severity Index (PWASI™)
Axis Intelligence Research introduces the Persistence-Weighted Attack Severity Index (PWASI), the first composite metric that ranks AI memory poisoning attack vectors on four dimensions simultaneously: how reliably the attack injects malicious content (injection success rate), how reliably that content causes the target behavior (attack success rate), how long the poisoned entry persists, and how much access the attacker required.
Formula (v1.0, baseline July 30, 2026):
PWASI = (ISR × 0.40) + (ASR × 0.35) + (P_duration × 0.15) + (Privilege_inversion × 0.10)
Where:
- ISR = Injection Success Rate (reported value, normalized 0–1)
- ASR = Attack Success Rate (reported value, normalized 0–1)
- P_duration = Persistence score: ephemeral (ends with session) = 0; cross-session = 0.5; indefinite until manually purged = 1.0
- Privilege_inversion = 1 − privilege level required: no-privilege attacker = 1.0; trigger-optimization required (partial) = 0.70; admin/model access = 0
- Output × 100 = index reading (0–100 scale)
Weight rationale: ISR carries the highest weight (40%) because an attack that cannot inject reliably produces no threat regardless of downstream success rates. ASR carries 35% because injection without behavioral consequence is irrelevant. Persistence (15%) differentiates durable threats from session-scoped ones. Privilege requirement (10%) captures operational accessibility.
PWASI baseline readings (July 30, 2026):
| Attack Vector | ISR | ASR | P_dur | Priv | PWASI Score |
|---|---|---|---|---|---|
| PoisonedRAG | 0.98 | 0.97 | 1.0 | 1.0 | 98.2 |
| MINJA | 0.982 | 0.70 | 1.0 | 1.0 | 88.8 |
| AgentPoison | 0.82 | 0.80 | 1.0 | 0.70 | 82.8 |
| eTAMP | 0.325 | 0.325 | 1.0 | 1.0 | 49.4 |
PoisonedRAG tops the index (98.2/100) because it combines near-perfect retrieval reliability with the highest reported ASR and requires no attacker privileges. MINJA follows at 88.8 — exceptional injection reliability, somewhat lower conversion to behavioral compromise. AgentPoison at 82.8 reflects the trigger-optimization requirement, which imposes partial operational cost on an otherwise high-severity attack. eTAMP at 49.4 reflects its substantially lower ASR against production models, partially offset by unique cross-site persistence and zero privilege requirements.
Limitation: PWASI evaluates published research results, which are obtained under controlled experimental conditions. Production environments include additional controls — prompt-level classifiers, rate limits, content filters — that are not consistently modeled in the papers. eTAMP’s ASR, in particular, may understate real-world risk if production systems prove more susceptible than the WebArena evaluation environment. Readings will be updated as new peer-reviewed results become available.
License: CC BY 4.0. Attribution: “Axis Intelligence Research PWASI™ v1.0, July 30, 2026, axis-intelligence.com/ai-memory-poisoning-statistics/.”
Marcus Chen: What the PWASI baseline reveals is that the “harder to exploit” characterization sometimes applied to RAG poisoning is not supported by the data. PoisonedRAG requires only five injected documents in a database of millions. The operational question is not “can an attacker do this” — it’s “how many of our production data ingestion pipelines accept external document uploads from untrusted sources.” For most enterprises, the answer is more than one.
Real-World Incidents and Proof-of-Concept Exploits
EchoLeak: CVE-2025-32711 in Microsoft 365 Copilot
The research record for production AI memory and context poisoning begins — for practical purposes — with EchoLeak, disclosed in June 2025. Aim Security researchers identified CVE-2025-32711, a zero-click vulnerability in Microsoft 365 Copilot rated CVSS 9.3. A single crafted email — requiring no user interaction beyond receiving it — caused Copilot to access internal files and exfiltrate their contents to an attacker-controlled server.
The attack exploited an “LLM scope violation” in Copilot’s RAG retrieval mechanism: the hidden prompt payload, embedded as an HTML comment or white-on-white text invisible to the user, was parsed and retained by Copilot’s LLM engine. When the user later requested a summary of recent communications, the RAG engine retrieved the email, the hidden instructions executed, and Copilot leaked sensitive data — documents, Teams messages, SharePoint contents — that it had legitimate access to. Microsoft patched the specific vulnerability server-side and confirmed no confirmed exploitation in the wild before the patch.
EchoLeak matters beyond the specific CVE because it demonstrated a structural attack surface: any LLM-based assistant with access to multiple internal data sources and a retrieval mechanism is susceptible to the same class of prompt-context injection. The scope violation is architectural, not incidental.
MemoryTrap: Claude Code Vulnerability (April 2026)
On April 1, 2026, Cisco researchers disclosed MemoryTrap, a memory poisoning vulnerability in Claude Code in which a malicious file encountered during an agent-initiated code review could write persistent false context that survived across sessions. The vulnerability was patched by Anthropic in Claude Code v2.1.50 and served as the anchor case for the OWASP blog post on ASI06 co-authored by Cisco’s Idan Habler in May 2026.
SpAIware Pattern: ChatGPT Cross-Session Memory Injection
Researcher Johann Rehberger documented the SpAIware pattern in September 2024, demonstrating how indirect prompt injection could be used to write persistent instructions into ChatGPT’s memory feature via document upload and browser tool vectors. The injection survives agent restart and persists until manually cleared. The attack vectors target the long-term memory stores of consumer AI assistants including ChatGPT, Claude Projects, and Gemini workspace context, all of which store per-user preference and task context across sessions.
Honeypot Data: 91,000 Attack Sessions in 90 Days
Published research from honeypot monitoring captures the volume dimension. Between October 2025 and January 2026, researchers captured over 91,000 attack sessions targeting LLM model endpoints, including more than 80,000 enumeration requests methodically probing 73+ model endpoints across every major model family. The data establishes that memory and context attack surfaces are being actively probed at industrial scale — this is not theoretical research interest.
Multi-Agent Cascade Effects
The threat is not bounded by a single agent. In multi-agent architectures — where specialized agents hand off tasks, share memory, and communicate through standard inter-agent channels — a single poisoned agent can propagate compromised context through the entire network.
Galileo AI’s research on multi-agent system failures (December 2025, reported in Obsidian Security analysis) found that in simulated multi-agent systems, a single compromised agent poisoned 87% of downstream decision-making within four hours. The cascade progresses through what appear to be normal inter-agent communications; tracing it back to the poisoned source requires visibility that most production agent orchestration frameworks do not currently provide.
BackdoorAgent (Feng et al., 2026), which tested backdoor attacks across three agentic workflow stages — planning, memory, and tool-use — found a 77.97% trigger persistence rate for memory-stage attacks and demonstrated cross-stage propagation. A trigger installed in the memory stage propagates into tool-use and planning stages during subsequent sessions.
The OWASP Agentic Top 10 taxonomy makes the attack chain explicit: ASI01 (goal hijack) and ASI06 (memory poisoning) are entry points; ASI02 (tool misuse) and ASI05 (unexpected code execution) are where the impact materializes. Patching the entry point without patching the impact chain, or vice versa, leaves the full attack chain functional.
| Cascade Metric | Finding | Source | As-Of Date |
|---|---|---|---|
| Downstream decision-making poisoned by single agent | 87% within 4 hours | Galileo AI / Obsidian Security analysis | Dec 2025 |
| Memory-stage trigger persistence (BackdoorAgent) | 77.97% | Feng et al., 2026 (arXiv:2605.16282) | 2026 |
| Cross-agent propagation in simulated MAS | Demonstrated | Torra & Bras-Amorós, arXiv:2603.20357 | Mar 2026 |
How Effective Are Current Defenses?
The research consensus on defense effectiveness is uncomfortable: current defenses are insufficient as standalone controls, and they are often insufficient even in combination.
Agent Security Bench (arXiv:2410.02644), published at ICLR 2025, tested 11 defensive methods against 16 attack types across 13 LLM architectures. The paper’s conclusion: existing defenses are “often ineffective” against combined attacks. The 84.30% peak average attack success rate was achieved by a mixed attack; even against isolated attack types, defenses failed to reliably suppress success rates below operationally concerning levels.
A-MemGuard research, cited in multiple 2026 survey papers, found that even advanced LLM-based memory classifiers miss 66% of poisoned entries — because instructions like “always prioritize urgent-looking emails” appear semantically reasonable in isolation. The malicious intent only surfaces when the entry is combined with a specific query context that no static classifier can anticipate.
SMSR (Certified Defence Against Runtime Memory Poisoning, arXiv:2606.12703) represents the current leading edge of formal defense work — a certified runtime layer providing quantifiable guarantees under defined threat models. The paper is explicit that it addresses only the runtime memory write path; it does not cover RAG corpus poisoning or environmental observation attacks.
What the defense landscape looks like in practice: layered controls across ingestion, retrieval, and behavioral monitoring are necessary but none are individually sufficient. Provenance metadata on memory writes — tracking original source, injection timestamp, trust level, and validation state — is the defensive primitive that appears most consistently across 2026 recommendations. Without it, incident response has no forensic trail to follow.
| Defense Approach | Limitation | Source |
|---|---|---|
| LLM-based memory classifiers | Miss 66% of poisoned entries | A-MemGuard (cited in arXiv:2601.05504) |
| Permission-based restrictions (block malicious sites) | Bypassed by eTAMP environmental injection | arXiv:2604.02623 |
| Paraphrasing defenses | Insufficient against PoisonedRAG | USENIX Sec 2025 |
| Static corpus defenses (RobustRAG, ReliabilityRAG) | No coverage for runtime-injected entries | arXiv:2606.12703 |
| Mixed layered controls | Best available; no formal guarantee | OWASP ASI06, 2026 |
Memory Types and Their Poisoning Surfaces
Not all AI memory is equivalent from an attack surface perspective. Production agents typically use at least four distinct memory types, each with different poisoning characteristics.
In-context (short-term) memory is the active conversation history — prior turns, tool call results, intermediate reasoning. Attacks here are session-scoped: they end when the conversation closes. High impact within session; zero persistence.
Episodic memory stores past interaction records — what the agent did, what it observed, what outcomes resulted. MINJA attacks this layer. Entries persist across sessions; the agent retrieves them as demonstrations for future similar queries. Poisoned episodic entries are the “sleeper” variant: they sit dormant until a semantically matching query triggers them.
Semantic memory consists of vector databases — Pinecone, Weaviate, Chroma, Qdrant, pgvector — where documents are embedded and retrieved by cosine similarity. This is the RAG layer, the most studied poisoning surface. AgentPoison and PoisonedRAG attack this layer. Poisoned entries persist indefinitely in the vector store unless explicitly removed.
Trajectory memory records the agent’s browsing or tool-execution history. eTAMP attacks this layer, demonstrating that a single poisoned environmental observation can corrupt future sessions on entirely different sites.
February 2026 research on implicit memory (arXiv:2602.08563) found that even agents without explicit memory modules are vulnerable: LLMs encode state in their outputs and retrieve it when those outputs are reintroduced as inputs, creating what amounts to an implicit memory attack surface that has no memory module to audit.
Enterprise Deployment Context: Why This Matters Now
The threat has arrived before the defenses, and the deployment rate is accelerating. Deloitte’s State of AI in the Enterprise 2026 survey of 3,235 leaders across 24 countries found that roughly three-quarters of enterprises expect at least moderate agentic AI use within two years, while only 21% have a mature governance model for autonomous agents. Deloitte’s 2025 Emerging Technology Trends study found that while 38% of organizations were already piloting agentic solutions, only 11% had systems actively running in production.
That gap matters for memory poisoning because persistent memory is what makes agents useful — and persistent memory is the attack surface. The 11% in production today are already running agents with vulnerable memory stores. The 74% expecting moderate deployment within two years are building those stores now, while the defense literature is still catching up with the attack literature.
Gartner forecasts that over 40% of agentic AI projects will be canceled by end of 2027 on grounds of cost, unclear value, or inadequate risk controls. Memory poisoning sits squarely in the “inadequate risk controls” category.
Marcus Chen: The Deloitte figure — only 21% have mature agent governance — is the operational context for the attack success rates above. MINJA’s 98.2% injection success rate is a research-environment number. The enterprise number will be lower. But lower than 98.2% leaves a great deal of room for attacks that succeed in practice.
The Keyword and Framing Question: “Statistics” vs. Other Formats
Why this page uses “statistics”: Security practitioners, CISO teams, researchers, journalists, and LLMs querying for this topic search for quantified, citable figures — success rates, benchmark scores, timeline data. “AI memory poisoning statistics” accurately describes what this page delivers and matches the query intent that primary sources and backlinks require.
Methodology
Data collection: All statistics in this article derive from peer-reviewed research papers accessed directly via arXiv, NeurIPS, USENIX Security, ICLR, and OpenReview, plus primary CVE sources and OWASP’s published documentation. No figure in this article derives from secondary aggregators, vendor marketing materials, or model memory.
Source verification: Every cited URL was accessed during the production session (July 30, 2026). Attack success rates are taken from the primary papers’ own reported experimental results; where multiple configurations exist, the specific condition is stated inline (e.g., “black-box setting,” “GPT-5-mini,” “NQ dataset”).
PWASI computation: Formula, inputs, weights, and arithmetic are disclosed in the “Axis Intelligence Research: PWASI” section. Arithmetic was Python-verified on July 30, 2026. The formula is versioned v1.0; any future changes to components or weights will be documented with a version bump and re-baselined readings.
Scope and limitations: The attack success rates reported come from controlled experimental environments. Production deployments typically include additional controls — content filters, rate limits, prompt classifiers — not fully captured in laboratory settings. eTAMP’s ASR in particular was measured on the WebArena evaluation framework, which may not fully replicate real-world UI conditions. The PWASI baseline covers four attack vectors studied in peer-reviewed literature as of July 30, 2026; it is not exhaustive of all memory poisoning techniques.
Older data note: AgentPoison’s core experimental results date to July 2024 (NeurIPS 2024). These remain the canonical figures because no paper published since has replaced them with newer experimental data against the same agent types. PoisonedRAG’s core results were presented at USENIX Security 2025 (paper first appeared on arXiv in February 2024).
About This Dataset
The Axis Intelligence Research AI Memory Poisoning Statistics dataset covers peer-reviewed attack success rates, real-world CVE disclosures, multi-agent cascade findings, and defense effectiveness data for AI memory and RAG poisoning as documented in published literature from 2024 through July 2026. Axis Intelligence Research compiled these statistics from primary conference proceedings and preprint repositories; the PWASI metric is an original Axis Intelligence Research computation.
License: CC BY 4.0
Cite as: Axis Intelligence Research, “AI Memory Poisoning Statistics 2026,” July 2026, axis-intelligence.com/ai-memory-poisoning-statistics/
Dataset download: [ai-memory-poisoning-statistics.csv]
Citation Block
APA:
Axis Intelligence Research. (2026, July 30). AI Memory Poisoning Statistics 2026: Attack Rates, Real-World Exploits & Defense Gaps. axis-intelligence.com/ai-memory-poisoning-statistics/
MLA:
Axis Intelligence Research. “AI Memory Poisoning Statistics 2026: Attack Rates, Real-World Exploits & Defense Gaps.” Axis Intelligence Research, 30 July 2026, axis-intelligence.com/ai-memory-poisoning-statistics/.
Chicago:
Axis Intelligence Research. “AI Memory Poisoning Statistics 2026: Attack Rates, Real-World Exploits & Defense Gaps.” July 30, 2026. https://axis-intelligence.com/ai-memory-poisoning-statistics/.
Frequently Asked Questions
What is the current attack success rate for AI memory poisoning?
Reported rates vary significantly by attack type and experimental conditions. At the high end, PoisonedRAG achieved 91–99% attack success against RAG systems with PaLM 2 in black-box settings (USENIX Security 2025). MINJA achieved 98.2% injection success and 70%+ attack success against memory-augmented agents using only normal user queries (NeurIPS 2025). Against production AI browsers under eTAMP (April 2026), attack success rates ranged from 19.5% to 32.5% under standard conditions — substantially lower, but reflecting production-system defenses not present in isolated lab settings.
How does memory poisoning differ from prompt injection?
Prompt injection is a session-scoped attack: the injected instruction affects the current conversation and ends when the session closes. Memory poisoning writes the malicious instruction into the agent’s persistent memory store — its RAG database, episodic log, or trajectory record — where it persists indefinitely across sessions. The attack and its effect are temporally decoupled: an adversary can plant a poisoned entry today that activates on a completely unrelated query weeks later. OWASP’s ASI06 classification was created specifically to distinguish memory poisoning from prompt injection (ASI01) in the 2026 Agentic AI Top 10.
Which AI systems are vulnerable to memory poisoning?
Any AI agent with a persistent memory store is in scope. Research has demonstrated attacks against RAG-based agents using Pinecone, Weaviate, Chroma, Qdrant, and pgvector; against agents built on ChatGPT, Claude, Gemini, GPT-4, GPT-4o, GPT-4o-mini, GPT-5.2, and Llama-3.1-8B; against enterprise AI assistants including Microsoft 365 Copilot (CVE-2025-32711); and against consumer AI browsers including ChatGPT Atlas and Perplexity Comet (eTAMP, April 2026). February 2026 research also found that agents without explicit memory modules remain vulnerable through implicit state encoding in outputs.
What is the PWASI (Persistence-Weighted Attack Severity Index)?
PWASI is an original Axis Intelligence Research composite metric that ranks AI memory poisoning attack vectors across four dimensions: injection success rate (40% weight), attack success rate (35% weight), persistence duration (15% weight), and privilege inversion — how little access the attacker requires (10% weight). The v1.0 baseline, computed July 30, 2026, ranks PoisonedRAG at 98.2/100, MINJA at 88.8/100, AgentPoison at 82.8/100, and eTAMP at 49.4/100. The full formula, inputs, and weights are disclosed in this article. PWASI is licensed CC BY 4.0; attribution: “Axis Intelligence Research PWASI™ v1.0.”
Are defenses against memory poisoning effective?
The research consensus as of mid-2026 is that no single defense is reliably effective. Agent Security Bench (ICLR 2025) tested 11 defensive methods against 16 attack types and found existing defenses “often ineffective” against combined attacks. A-MemGuard research found that even advanced LLM-based memory classifiers miss 66% of poisoned entries. eTAMP demonstrated that permission-based defenses — blocking agent actions on malicious sites — fail entirely against environmental-observation attacks. The most defensible current posture is layered: input moderation with trust scoring, provenance metadata on every memory write, retrieval-time validation, and behavioral monitoring for anomalous patterns. Certified formal guarantees exist only for specific, narrow threat models (arXiv:2606.12703).
What is OWASP ASI06?
ASI06 is the Memory & Context Poisoning entry in OWASP’s Top 10 for Agentic Applications 2026, published by the OWASP GenAI Security Project on December 9, 2025 and updated to version 2.01 on June 1, 2026. ASI06 covers attacks where an agent’s persistent memory, retrieval layer, or runtime context is shaped to mislead future reasoning steps. It was added alongside nine other agentic-specific risks (ASI01–ASI10), distinct from the earlier Top 10 for LLM Applications, because the agentic threat model requires persistence, cross-session scope, and multi-agent propagation analysis that the LLM-level framework was not designed to handle.
How quickly can a single compromised agent affect a multi-agent system?
Galileo AI’s research on multi-agent system failures (December 2025) found that in simulated systems, a single compromised agent poisoned 87% of downstream decision-making within four hours. The cascade propagates through normal inter-agent communications and is difficult to trace without deep observability into agent-to-agent interaction logs. BackdoorAgent (2026) separately demonstrated that a trigger installed in the memory stage of a multi-agent workflow propagates into tool-use and planning stages during subsequent sessions, with a 77.97% trigger persistence rate.
What was EchoLeak and why does it matter?
EchoLeak (CVE-2025-32711, CVSS 9.3) was a zero-click indirect prompt injection vulnerability in Microsoft 365 Copilot, disclosed by Aim Security researchers in June 2025. A crafted email — requiring no user interaction — caused Copilot to access internal files (Teams messages, OneDrive documents, SharePoint content) and exfiltrate their contents. Microsoft patched the vulnerability server-side and confirmed no confirmed exploitation in the wild before the patch. EchoLeak matters as a structural milestone: it was the first documented case of prompt injection weaponized for data exfiltration in a large-scale production AI system, and it demonstrated that the RAG retrieval mechanism in AI assistants constitutes an attack surface that persists even when individual CVEs are patched.
Where can I access the full dataset?
The Axis Intelligence Research AI Memory Poisoning Statistics dataset is available as a CC BY 4.0 CSV download on this page and on Hugging Face and Kaggle. The dataset includes all statistics cited in this article, with provenance columns: source organization, source document, URL, retrieval date, whether the row is a primary source, whether it is Axis-calculated, and a methodology note for calculated rows.