AI Agent Context Poisoning
Description
Adversaries may attempt to manipulate the context used by an AI agent's large language model (LLM) to influence the responses it generates or actions it takes. This allows an adversary to persistently change the behavior of the target agent and further their goals.
Context poisoning can be accomplished by prompting the LLM to add instructions or preferences to memory (See Memory) or by simply prompting an LLM that uses prior messages in a thread as part of its context (See Thread).
- ATLAS ID
- AML.T0080
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Generative AIAgentic AI
Sub-techniques
Mitigations
- AML.M0031Memory Hardening
Memory hardening reduces persistent context poisoning by controlling what an agent may save as memory, preventing saved data from becoming higher-authority instructions, and enabling poisoned records to be identified, quarantined, and rolled back.
- AML.M0035AI Red Team
Attempt to persist malicious instructions in agent memory and long-lived threads. Verify authorization for context changes, integrity checks, trust labeling, expiration, user visibility, and remediation.
Case studies that use it
No ATLAS case study records this technique yet. Browse all case studies.