The Attack Surface of Agent Memory: When Memories Become Persistent Backdoors
Memory turns prompt injection from a one-shot nuisance into a persistent backdoor: MINJA shows conversation-only injection succeeds >95% of the time, and SpAIware demonstrated continuous data exfiltration via planted memories. The industry's two defensive lines — citation-based verification (Copilot) and human approval inboxes (Gemini CLI / Devin) — each have blind spots.