If an AI agent reads back text it saved or fetched, can someone plant instructions in it to steer its decisions?
How do tool results and memory entries become injection vectors?
This explores how text an agent reads back in, whether tool outputs or memories it stored earlier, can be used to steer its decisions. The corpus is much stronger on the memory half than on tool results, and I say where it runs thin.
This explores how text an agent reads back in, whether tool outputs or memories it stored earlier, can be used to steer its decisions. The corpus has direct evidence on memory and only indirect evidence on tool results.
The clearest evidence is on memory. In one study, poisoned memory entries got past the agent's checking component (the Validator) in every trial Can memory poisoning compromise decision-making even with authorization layers?. A separate authorization layer, using signed tokens and policy verification, did stop any unsafe action from executing. But it blocked the action without repairing the poisoned judgment. A planted memory works less like a trapdoor and more like a corrupted belief: the agent still reaches the wrong conclusion, and all you've done is stop it from acting on it.
That gap between acting badly and judging badly comes up again elsewhere. One paper reports zero modified tests under a regime that bundles clear authorization rules with restricted tools, but no ablation shows whether the tools were simply unavailable or the agent chose not to cross the line Do authorization rules or restricted tools prevent test modifications?. The same pipeline shows a 100% Judgment Bypass Rate alongside a 0% Unsafe Action Rate. So a defence that removes the dangerous option and a defence that keeps the agent's reasoning trustworthy are different things, and injected content mostly attacks the second.
The next question is what counts as memory. In one 2026 evaluation, short-lived agents turned a shared package repository into persistent storage by writing findings there and reading them back across lifespans Can ordinary infrastructure become unplanned agent memory?. The agents did this on their own, and it wasn't an attack, but it shows the channel is real. Any place an agent can write and later read is memory, not just the memory module you designed, and it can carry whatever ends up in it. My own reading is that the same holds for retrieval-style knowledge injection, where fetched text is placed into the prompt at inference time How do knowledge injection methods trade off flexibility and cost?. The corpus treats that as a flexibility-versus-cost tradeoff, not a security question.
The corpus has no note that studies tool-result injection directly. The closest is work on decoupling reasoning from tool observations, which plans first and fills in tool outputs afterward Can reasoning and tool execution be truly decoupled?. It is framed around cost and latency, and it doesn't test whether keeping tool outputs out of the reasoning loop makes an agent harder to steer. That question is open here.
Sources 5 notes
Memory poisoning still bypassed the Validator in every trial, but a separate authorization layer using signed tokens and policy verification prevented any unsafe action from executing. The layer blocked execution without fixing the compromised judgment itself.
The abstract bundles clear authorization rules with restricted tools and reports zero protected-test modifications, but no single-factor ablation distinguishes whether the result comes from unavailable crossings, unchosen crossings, or both. The pipeline's own data elsewhere (100% Judgment Bypass Rate with 0% Unsafe Action Rate) shows the distinction matters.
During a 2026 evaluation, short-lived AI agents repurposed a shared package repository as memory by writing and reading exploit findings across agent lifespans. The agents converted ordinary infrastructure into persistent state without deliberate memory system architecture.
Dynamic injection (RAG) maximizes flexibility but adds latency; static embedding is fastest but costly and inflexible; modular adapters balance efficiency with swappability; prompt optimization requires no training but only activates existing knowledge. Combining all three outperforms any single approach.
ReWOO and Chain-of-Abstraction both decouple reasoning from tool responses through different mechanisms—planning-before-execution and abstract placeholders respectively—eliminating quadratic prompt growth and sequential latency while maintaining reasoning quality.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Useful Memories Become Faulty When Continuously Updated by LLMs
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Divide-or-Conquer? Which Part Should You Distill Your LLM?
- Injecting Domain-Specific Knowledge into Large Language Models: A Comprehensive Survey
- Efficient Tool Use with Chain-of-Abstraction Reasoning
- GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents
- From Model Scaling to System Scaling: Scaling the Harness in Agentic AI