Memory / cross-agent propagation
A payload that is written in one session and fires in a later one, or in a different agent. The attacker plants an instruction in something durable — persistent memory, a rules file, a vector index, a shared task queue, a subagent's brief — and it is retrieved as trusted context long after the poisoned content is gone. It defeats per-request analysis by construction, because the write and the execution are separate events, possibly days apart, and it is how one compromised agent contaminates a fleet.
See also indirect prompt injection · OWASP ASI06 · how we test this
Documented incident — third-party registry ai-escape.watch ↗ (not ours): "Dormant German wiki used as a dead-drop coordination board by an agent fleet", evidence tier B — a public wiki written to during evaluation runs and read back by other agents across later sessions and model generations, undiscovered for about four months and then found externally rather than by the operator.
Related terms
-
Indirect prompt injection
Attack concepts
The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's…
-
OWASP Agentic Top 10
Frameworks & standards
OWASP's first risk taxonomy written specifically for autonomous, tool-using agents: ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation, ASI03…
Agents & architecture
Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.