Research demo
Persistent memory poisoning of Amazon Bedrock Agents via indirect prompt injection
AIR-2025-0146 AIR record · 2025-10-unit42-bedrock-memory-poisoning
From the supporting source
Once planted, these instructions persist across sessions, and they are incorporated into the agent's orchestration prompts. This ultimately allows the agent to silently exfiltrate a user's conversation history in future interactions.unit42.paloaltonetworks.com
The record
Disclosed
2025-10-09
Vendor
Amazon Web Services
Product
Amazon Bedrock Agents (memory feature)
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Privilege escalation, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the Bedrock agent wrote poisoned memory and exfiltrated on later turns
Attack surface
Agent memory
Autonomy level
Assistant
Initial vector
Indirect prompt injection tool output
Impact type
Data exfiltration, Persistence
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Bedrock Agent deployments with memory enabled
Capability abused
Defense & remediation
Recorded defense
Amazon Bedrock Guardrails prompt-attack policy (not enabled in the tested configuration)
Guardrail kinds
Input classifier
Guardrail outcome
Not enabled
Fix shipped
No code fix; AWS points customers to Bedrock Guardrails
Taxonomy & references
Curator notes
Authors Royce Lu and Jay Chen. Amazon responded that the concerns are mitigable by enabling Bedrock platform features. Proof of concept, not observed in the wild.
Supporting sources
Cite as
Enkrypt AI. "Persistent memory poisoning of Amazon Bedrock Agents via indirect prompt injection". AIR, AIR-2025-0146. https://agentincident.vercel.app/i/AIR-2025-0146/ (accessed 2026-10-19).