AIR-2026-0114 · Sleeper memory poisoning: dormant fabricated memories written into production assistants from untrusted content

Sleeper memory poisoning: dormant fabricated memories written into production assistants from untrusted content

AIR-2026-0114 AIR record · 2026-05-sleeper-memory-poisoning-production-assistants

From the supporting source

poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6arxiv.org

The record

Disclosed

2026-05-14

Vendor

OpenAI; Moonshot AI

Product

GPT-5.5; Kimi K2.6 (and production assistant web interfaces)

Risk domain

Agent behaviour › Unsafe actuation

Also touches

Data and memory poisoning, Privilege escalation, Confused deputy

System type

Generative model

Who acted

Agent acted — the assistants wrote and later acted on the poisoned memories

Attack surface

Agent memory

Autonomy level

Assistant

Initial vector

Indirect prompt injection document or webpage

Impact type

Memory poisoning, Persistence, Unauthorized action

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI01 – Agent Goal Hijack
MITRE ATLAS: AML.T0048 – External Harms
NIST AI RMF: MEASURE 2.6; MANAGE 1.3
EU AI Act: Annex III §1(c)
ISO/IEC: TR 24028; 24029-1; 23894
AIUC-1: C. Safety
Scope: agent misuse
Mitigation: Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

users of memory-enabled assistant products who process attacker-influenced content once

Capability abused

memory_writememory_retrievaltool_use

Defense & remediation

Recorded defense

model-level injection defenses; memory-write heuristics

Guardrail kinds

Unknown

Guardrail outcome

Silent

Curator notes

Pulipaka, Hlebik, Raghav, Abdelnabi, Raina, Sheth, Fritz. 'Hidden in Memory: Sleeper Memory Poisoning in LLM Agents', arXiv 2605.15338, 14 May 2026 (rev. 18 May). Attacks stay dormant and re-emerge across later conversations; among successful retrievals, poisoned memories drive attacker-intended agentic actions in 60-89% of evaluations. Included as an incident rather than treated as a benchmark paper because the named targets are shipped model products and the paper reports manual testing on production web interfaces. Key asymmetry vs prompt injection: memory poisoning needs only one successful write.

Cite as

Enkrypt AI. "Sleeper memory poisoning: dormant fabricated memories written into production assistants from untrusted content". AIR, AIR-2026-0114. https://agentincident.vercel.app/i/AIR-2026-0114/ (accessed 2026-10-19).