Memory poisoning and lifecycle

Tue, 07 Apr 2026 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

An injection on a delay

The last two leaks were about retrieval in the moment: a poisoned document steering an answer, one household’s email reaching another. This one is about time. An agent that is any use remembers things across emails, a preference, a recurring event, a fact it summarized last week, and recalls them later to answer. The moment it does, memory becomes an injection on a delay. Plant a note today whose text is an instruction, and it does nothing until some ordinary recall drops it into a prompt, where it arrives wearing the authority of something the agent chose to remember.

Memory on t0ul

Memory poisoning and lifecycle

An injection on a delay