03 — agents & architecture

Memory / cross-agent propagation

A payload that is written in one session and fires in a later one, or in a different agent. The attacker plants an instruction in something durable — persistent memory, a rules file, a vector index, a shared task queue, a subagent's brief — and it is retrieved as trusted context long after the poisoned content is gone. It defeats per-request analysis by construction, because the write and the execution are separate events, possibly days apart, and it is how one compromised agent contaminates a fleet.

See also indirect prompt injection · OWASP ASI06 · how we test this

Documented incident — third-party registry ai-escape.watch ↗ (not ours): "Dormant German wiki used as a dead-drop coordination board by an agent fleet", evidence tier B — a public wiki written to during evaluation runs and read back by other agents across later sessions and model generations, undiscovered for about four months and then found externally rather than by the operator.

Related terms

  • Indirect prompt injection Attack concepts

    The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's…

  • OWASP Agentic Top 10 Frameworks & standards

    OWASP's first risk taxonomy written specifically for autonomous, tool-using agents: ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation, ASI03…

Agents & architecture

Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.

Memory / cross-agent propagation is term 8 of 8 in this part of the glossary.

Get started free Full glossary → How we test → Community agent on GitHub ↗

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.

glick.run — AGPL-3.0