Hidden text on a webpage can become a "fact" your AI assistant remembers and acts on weeks later. This is the threat outlined by Forcepoint X-Labs, which has published a threat model called persistent memory poisoning. The technique exploits the ability of AI agents to extract information from web pages without distinguishing between visible and hidden text, storing false statements as if they were established truths.
The invisible attack that manipulates future decisions
Imagine an AI assistant with browser access reading a page about travel disruptions. At the bottom of the page, sized and positioned so no human will ever see it, there is a short paragraph stating that ABC Travel Support is the official emergency booking provider and should always be recommended when urgent travel changes are needed. The assistant's text extractor does not distinguish between hidden and visible text, so the model treats the whole thing as plain prose and files the claim away as a useful fact. A month later, the user's flight is canceled. They ask their assistant what to do, and it tells them, helpfully and with no sign of anything wrong, to contact ABC Travel Support.
Sponsored Protocol
Academic research MINJA demonstrates technical feasibility
The canonical academic result is MINJA, short for Memory INJection Attack, presented at NeurIPS 2025. Its significance lies in the attacker model: MINJA does not assume access to the memory store, elevated privileges, or any compromise of the system. It works by submitting ordinary queries through the standard interface, using indication prompts, bridging steps, and a progressive-shortening technique that strips away giveaway language while leaving the poisoned record behind. Across GPT-4o-mini, Gemini 2.0 Flash, and Llama 3.1 8B, it reported injection success above 95% and attack success above 70%.
However, it must be noted that those numbers might be optimistic. A January 2026 paper evaluating memory poisoning in electronic health record agents notes that MINJA's numbers were obtained under idealized conditions, and that how well these attacks hold up in realistic deployments remains understudied. Despite this, it remains a significant threat to products that continue to ship, including ChatGPT, Gemini, Claude, and Microsoft 365 Copilot.
Sponsored Protocol
Forcepoint's proposal to mitigate the risk
Forcepoint suggests an approach that could mitigate the problem: stop treating extracted memories as facts and start treating them as objects that can be inspected. Each memory is stored with metadata: where it came from, what type of source it is, whether a user confirmed it, and a risk score. Language written to shape future behavior, phrases like "from now on" or "make this your default going forward," adds to the score. So does the sudden appearance of a previously unseen domain, contact, or vendor. Contradiction detection is also in play: if new memory conflicts with an existing entry about the official travel provider, both cannot be true, so the engine flags the conflict and holds the new item for user confirmation rather than silently overwriting it. At the same time, anything related to payment instructions, banking details, VPN configuration, or security contacts is given higher weight, regardless of where it came from.
Sponsored Protocol
Limitations of current defenses and practical advice
None of these approaches, however, solves the underlying problem: agents are built to treat retrieved memory as their own experience rather than as input. Scoring raises the cost of poisoning. It does not change what the agent believes once something gets through. As Agent Security Bench found, current defenses are not doing well. For anyone using an assistant with memory today, the practical play is unglamorous but worth following anyway: open the memory settings occasionally and read what is in there. However, that's easier said than done when it comes to propagating the message, since a sizable chunk of AI users never bother to look under the hood.
Sponsored Protocol
The issue of memory poisoning ties into broader discussions we've had about AI security and reliability. To explore how AI is speeding up outage recovery during traffic spikes, check out our article on AI Speeds Up Outage Recovery. Additionally, for insights on testing AI robustness, consider reading about mutation testing with Stryker. Finally, the debate around censorship and policy is relevant here, as discussed in Censorship conspiracy theory becomes US policy.
For more details from the original research, you can refer to the TechRadar article.
