15Prompt injectionBelow the top 20
Poisoning of long-term agent memory
CapabilityAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that personal and enterprise agents write ‘facts’ they will trust next week, there is a possibility of an attacker installing a standing lie in memory resulting in decisions made on a past that did not happen.
Likelihood
3Probable
Consequence
4Critical
Urgency
3Priority
Memory is a privilege-escalation primitive.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · Dual control on irreversible actions · Strict isolation of untrusted content from instructions · Hidden-text and steganographic scanning of filings · Pace rules: no irreversible action faster than a human can reconstruct it · A real off-ramp that still functions · Contract-first delegation with privilege attenuation · Duty of care on high-stakes delegates