When AI Remembers Too Much – Persistent Behaviors in Agents’ Memory

The Unit 42 article presents a PoC showing how indirect prompt injection can silently poison the long-term memory of an AI agent, demonstrated using Amazon Bedrock Agents with memory retention enabled. It explains that malicious instructions can be inserted into an agent’s memory via a manipulated webpage, persisting across sessions and becoming part of the agent’s orchestration prompts, which can lead to silent exfiltration of a user’s conversation history.

The researchers emphasise that this is not a Bedrock platform vulnerability but a broader prompt-injection risk in LLMs when untrusted content is ingested into system prompts. They note that memory can be retained for up to 365 days and that the attack is staged through social engineering to deliver a malicious URL to the chatbot.

Mitigation involves a layered defence, including pre-processing prompts, content filtering, URL filtering, and logging and monitoring, with practical protection available from Bedrock Guardrails and Prisma AIRS, according to Amazon Bedrock Guardrails. The piece also highlights that safeguarding memory and context management will be critical as AI agents grow more capable.