Memory Is a Feature. It Is Also an Attack Surface

AI agents (software systems that can plan and take actions over time) that retain memory between sessions create a security risk called Memory & Context Poisoning, where attackers can inject malicious instructions into persistent storage that the agent continues to trust and follow in future interactions. Researchers found a vulnerability called MemoryTrap in Claude Code where a developer could unknowingly approve a malicious dependency that would persist in the agent's memory and configuration files, poisoning the agent's behavior across multiple projects and sessions. The core problem is that agents treat stored memory, configuration files, and hooks as trustworthy guidance without validating whether they contain attacker-controlled content.