Context poisoning
Also called: context drift, memory poisoning
Corrupting the model's working context — its conversation history, retrieved documents, or persistent memory — so later steps inherit attacker-controlled content.
An agent accumulates context: past turns, tool outputs, notes it saved to memory, documents it retrieved. If any of that is attacker-influenced, the poison persists and compounds — a malicious instruction written into long-term memory on turn 3 keeps acting on turn 30. "Context drift" is the softer version, where accumulated noise and stale content degrade the agent's grounding over a long session.
Why it matters
It turns a one-shot injection into a persistent foothold and makes incidents hard to diagnose, because the triggering content is no longer on screen. Memory writes deserve the same scrutiny as tool calls, and long-running agents benefit from context that can be audited and reset.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.