What is context poisoning?

Context poisoning is the persistent corruption of what an AI agent treats as trustworthy context: long-term memory, saved notes, documents retrieved through RAG, output received from other agents in a swarm. Unlike prompt injection, which hijacks the model's behavior with a hostile input in a single turn, context poisoning settles in and stays: once a false or manipulated piece of data enters memory or shared context, the agent keeps treating it as true across later sessions, propagating the error into future decisions without anyone noticing right away. The OWASP GenAI Security Project classifies it as ASI06, Memory and Context Poisoning, in its Top 10 for Agentic Applications, explicitly distinguishing it from direct attacks that hijack a single goal. It is a governance problem about what enters a system's memory and stays there, not an isolated incident to filter out in one turn.

The mechanism and its propagation channels

Context poisoning does not require a sophisticated attack: it only takes one trusted source getting corrupted, whether by mistake or deliberate manipulation. A poisoned document retrieved through RAG can enter the context of a single answer, but if the agent saves it as a permanent note or writes it into its own long-term memory, the error survives the session that produced it. In an agent swarm the risk multiplies: a compromised or simply misinformed agent passes its poisoned output to other agents, which treat it as legitimate input and build on it without questioning it, a pattern documented by research on MINJA (Memory INJection Attack), which showed poisoned reasoning traces being injected and later retrieved as examples for future users. It also needs to be distinguished clearly from context rot: the latter is a passive decline caused by context length diluting the model's attention, while context poisoning is a data integrity problem, not a scale problem, and it can happen even in a short, well-structured context if a single source has been corrupted.

A concrete enterprise example

A procurement agent with persistent memory keeps, among its notes on vendor X, an entry saved months earlier from a compromised support ticket: "volume discount already approved at 15% above threshold Y". The note was never validated by a human, but it stays in the agent's memory and gets pulled up automatically every time the vendor comes up in a new negotiation, steering the agent's proposals toward terms that were never authorized. No single prompt was manipulated: the damage comes from one piece of data that entered once and was never checked again.

Why it matters for decision-makers

The lesson for anyone governing agentic systems is that guardrails designed to block hostile input in real time are not enough: what is needed is explicit governance over what enters persistent memory, who can write to it, with what tracked provenance and what verification cadence, a concern that sits squarely inside context engineering but goes beyond its day-to-day scope. AI red teaming that only tests single turns will not catch a piece of data poisoned months earlier; memory itself needs periodic checks, not just the current input.