Memory Poisoning vs. Prompt Injection: Know the Difference

They're often lumped together, but memory poisoning and prompt injection are different attacks with different fixes. Here's how to tell them apart.

Prompt injection is a one-shot attack. The malicious instruction is in the current context, and it influences the current action. Once the context is gone, the attack is over. Memory poisoning is different: the attacker plants a false fact or instruction into the agent's long-term memory, where it persists across sessions and corrupts every future decision.

Think of it this way. Prompt injection is a stranger shouting instructions in the room. Memory poisoning is someone editing the agent's diary so it 'remembers' things that never happened, and acts on them for weeks.

The fixes are different too. Prompt injection is best handled by verifying actions at execution time. Memory poisoning requires treating memory as a security boundary: validating what gets written, quarantining suspicious entries, and tracking the provenance of every memory so a poisoned entry can be traced and contained.

If you only defend against one, you're leaving the other door open. A real enforcement layer handles both: it blocks injection at the action boundary and it guards the memory write path.