How could organizations have prevented persistent prompt injection?

Organizations can mitigate risk by applying microsegmentation, enhanced monitoring, and explicit controls over how AI memory modules store, recall, and share user input.

What type of data is most at risk from such attacks?

Sensitive conversation histories, credentials, and confidential enterprise information embedded in AI interactions are particularly vulnerable to exfiltration via poisoned memory.

AI Agents Under Fire: Memory Poisoning and the Rise of Persistent Prompt Injection

Q: What compliance risks did the AI agent memory poisoning expose?

The incident highlighted gaps in data governance, visibility, and policy enforcement, raising concerns around frameworks like HIPAA, PCI DSS, and NIST when AI agents store and recall sensitive data.

The latest findings show how attackers exploit AI agent memory through indirect prompt injection, leaving organizations vulnerable to stealthy data exfiltration and manipulation.

Published: January 8, 2026

Share this on:

Executive Summary

In 2024, security researchers uncovered a novel AI/ML security incident where AI agents' long-term memory storage was compromised via persistent indirect prompt injection. Adversaries managed to embed malicious instructions within normal AI inputs; these poisoned prompts were subsequently retained by the AI's memory module. When later queries accessed this memory, the injected instructions could exfiltrate conversation history or impact future responses, creating a stealthy, long-term threat. The breach highlighted how modern agentic AI’s tendency to remember user input presents an unforeseen risk vector, with potential for data leakage and manipulation of AI-driven workflows.

This incident signals a rising trend: as enterprises integrate AI agents and persistent memory, attackers are quickly adapting with prompt-based exploit techniques that subvert traditional security controls. The risk of covert data exfiltration and ongoing manipulation through AI memory will become a central compliance and governance issue in highly regulated industries.

Why This Matters Now

AI-powered agents with persistent memory are being rapidly adopted across industries, yet most organizations lack visibility and controls over how data is stored and recalled within these agents. Persistent prompt injection exploits this blind spot, making it critical for security leaders to address AI memory risks before adversaries widely weaponize such techniques.

Attack Path Analysis

The attack began when a malicious prompt was injected into an AI agent, compromising its memory and underlying system. The attacker leveraged this to potentially gain higher logical influence over the AI agent’s privileged behaviors. They maneuvered laterally by persisting injected behaviors across different memory objects or workloads. Subsequently, the agent established covert command and control via outbound communications. Sensitive historical data was then exfiltrated through allowed egress channels. Ultimately, the attacker achieved impact by maintaining persistence in the AI’s long-term memory, leading to business and integrity risks.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

Mediuminferred

Lateral Movement

Mediuminferred

Command & Control

Mediuminferred

Exfiltration

High

Impact

High

Initial Compromise

Description

An attacker achieved initial access by injecting a malicious prompt into the AI agent’s input stream, planting persistent behavior in long-term memory.

Confidence:

High

Related CVEs

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2025-6965
CVSS 9
A memory corruption vulnerability in the AI agent's processing of external content allows attackers to execute arbitrary code via indirect prompt injection.
Affected Products:
Google Big Sleep AI Agent – < 3.50.2
Exploit Status:
exploited in the wild
References:
https://www.securityweek.com/google-says-ai-agent-thwarted-exploitation-of-critical-vulnerability/

MITRE ATT&CK® Techniques

Initial Access

T1566

Phishing

Execution

T1059.003

Command and Scripting Interpreter: Windows Command Shell

Persistence

T1546

Event Triggered Execution

Exfiltration

T1132

Data Encoding

Defense Evasion

T1027

Obfuscated Files or Information

Defense Evasion

T1036

Masquerading

Collection

T1056

Input Capture

Collection

T1114

Email Collection

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Protect stored cardholder data

Control ID: 3.2

Poisoning AI agent memory may result in unauthorized storage or disclosure of sensitive data retained in long-term memory, risking non-compliance with data protection mandates.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

Lack of robust controls for AI/ML memory management demonstrates a gap in the organization's cybersecurity policy covering emerging threats and memory-bound data retention.

DORA (Digital Operational Resilience Act) – ICT risk management framework

Control ID: Article 9

Persistently compromised AI memory reflects inadequate risk management for new ICT components and vulnerabilities, as required under operational resilience guidelines.

CISA Zero Trust Maturity Model 2.0 – Data Security and Classification

Control ID: Data Pillar – Data Security and Classification

Absence of strict controls over what AI long-term memory can retain or exfiltrate undermines core data classification and protection requirements in a zero-trust environment.

NIS2 Directive – Cybersecurity risk-management measures

Control ID: Article 21

A persistent poisoned AI agent memory exposes poor implementation of technical security measures and ongoing threat monitoring demanded for essential and important entities under NIS2.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Financial Services

AI memory poisoning threatens customer data confidentiality and regulatory compliance, requiring enhanced segmentation and threat detection for conversational banking systems.

Health Care / Life Sciences

Persistent AI agent vulnerabilities risk patient information exfiltration through poisoned memory, demanding zero trust controls and encrypted communication channels.

Information Technology/IT

AI/ML security threats target autonomous systems and agentic AI platforms, necessitating cloud-native security fabric and real-time anomaly detection capabilities.

Government Administration

Indirect prompt injection attacks compromise sensitive government AI systems, requiring multicloud visibility and robust egress security policy enforcement mechanisms.

Sources

When AI Remembers Too Much – Persistent Behaviors in Agents’ Memoryhttps://unit42.paloaltonetworks.com/indirect-prompt-injection-poisons-ai-longterm-memory/
Verified

Google Says AI Agent Thwarted Exploitation of Critical Vulnerabilityhttps://www.securityweek.com/google-says-ai-agent-thwarted-exploitation-of-critical-vulnerability/

Verified

How Microsoft defends against indirect prompt injection attackshttps://www.microsoft.com/en-us/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks/

Verified

Prompt injection attacks might 'never be properly mitigated' UK NCSC warnshttps://www.techradar.com/pro/security/prompt-injection-attacks-might-never-be-properly-mitigated-uk-ncsc-warns

Verified

Frequently Asked Questions

The incident highlighted gaps in data governance, visibility, and policy enforcement, raising concerns around frameworks like HIPAA, PCI DSS, and NIST when AI agents store and recall sensitive data.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Zero Trust and CNSF controls such as segmented networking, workload microsegmentation, inline threat detection, and egress enforcement would have detected or blocked adversary persistence and unauthorized data exfiltration by limiting lateral movement and monitoring outbound flows from compromised AI agents.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline inspection of AI interactions would alert on suspicious prompt structures and agentic behavior risks.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Restricts AI agent access to only authorized resources, reducing the blast radius.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Detects and blocks anomalous internal traffic that signals lateral spread.

Command & Control

Control: Threat Detection & Anomaly Response

Mitigation: Anomalous outbound C2 traffic is detected and alerted for response.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Sensitive data exfiltration by compromised agent is blocked or restricted.

Impact (Mitigations)

Limits the persistence and spread of malicious AI behaviors within Kubernetes environments.

Impact at a Glance

Affected Business Functions

Customer Support
Data Analysis
Automated Reporting

Operational Disruption

Estimated downtime: 5 days

Financial Impact

Estimated loss: $500,000

Data Exposure

Potential exposure of sensitive customer data due to AI agent manipulation via indirect prompt injection.

Recommended Actions

• Enforce zero trust segmentation and least privilege access for all AI agents and related workloads.
• Deploy inline CNSF controls to monitor and restrict suspicious AI prompt and memory manipulation.
• Implement east-west and egress policy enforcement to prevent lateral movement and unauthorized data exfiltration.
• Strengthen threat detection and anomaly response for AI/ML services to rapidly identify malicious persistence.
• Extend Kubernetes and cloud workload microsegmentation to reduce the impact of compromised agent behavior.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

AI Agents Under Fire: Memory Poisoning and the Rise of Persistent Prompt Injection

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

Related CVEs

CVE-2025-6965

Affected Products:

Exploit Status:

References:

MITRE ATT&CK® Techniques

Phishing

Command and Scripting Interpreter: Windows Command Shell

Event Triggered Execution

Data Encoding

Obfuscated Files or Information

Masquerading

Input Capture

Email Collection

Potential Compliance Exposure

PCI DSS 4.0 – Protect stored cardholder data

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA (Digital Operational Resilience Act) – ICT risk management framework

CISA Zero Trust Maturity Model 2.0 – Data Security and Classification

NIS2 Directive – Cybersecurity risk-management measures

Sector Implications

Financial Services

Health Care / Life Sciences

Information Technology/IT

Government Administration

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads