Poisoning 1.2% of agent memory cut accuracy to 0.300

Researchers poisoned 1.2% of an AI agent's long-term memory with plainly worded false statements and watched task accuracy fall from 0.850 to 0.300, according to a paper posted to arXiv. No jailbreak prompt, no trigger phrase, no retriever tuning. Just false assertions generated in a single pass and dropped into a LongMemEval-based memory corpus.

Anyone running persistent agent memory should worry about what happened next. The team's four-stage screening system reaches 0.832 recall on indirect prompt injection, a defense category most memory systems already lean on. Against this attack it rejected 0 of 360 poisoned entries. The paper's explanation is blunt: telling a false memory from a true one needs grounding outside the text itself, and injection filters don't have that.

Provenance-weighted retrieval performed no better than having no defense at all, statistically indistinguishable at p=0.80. The only setup that restored utility used a much stronger weight that excludes untrusted content entirely, turning the filter into an outright ban.

If your agent writes to memory from anything a user or a scraped page can influence, this paper is saying your write-time checks won't catch a plainly worded lie. The fix on the table isn't better screening. It's deciding what sources get write access to memory, and accepting what's lost by locking that down.