Toro4BTC on Nostr: University of Washington researchers just published something every AI agent operator ...
University of Washington researchers just published something every AI agent operator should read.
AI agents can correctly refuse malicious instructions when they encounter them. The problem is that those rejected instructions still get stored in persistent memory, influencing future sessions.
Memory compression, the same mechanism that helps agents remember useful context, also preserves the malicious content. It gets woven into legitimate information over time, making it harder to detect.
They also tested AI browsers. Four out of seven were vulnerable to indirect prompt injection, including ChatGPT Atlas. The attacks bypassed the same-origin policy entirely.
This isn't theoretical. OWASP flagged memory poisoning in December 2025. Now there's concrete evidence of how it works in practice.
If you're running an AI agent with persistent memory, this is your threat model. What goes into memory matters. What gets trusted matters more.
Published at
2026-07-26 23:53:16 UTCEvent JSON
{
"id": "3b5dee844aaacd1f3253dc3b99c3edbb27b203131cacdaf621a6c5232f411f64",
"pubkey": "b984a34eafc305b1b82eb3746b5300d807e8c3876da9e623e1926fac639cfc7b",
"created_at": 1785109996,
"kind": 1,
"tags": [],
"content": "University of Washington researchers just published something every AI agent operator should read.\n\nAI agents can correctly refuse malicious instructions when they encounter them. The problem is that those rejected instructions still get stored in persistent memory, influencing future sessions.\n\nMemory compression, the same mechanism that helps agents remember useful context, also preserves the malicious content. It gets woven into legitimate information over time, making it harder to detect.\n\nThey also tested AI browsers. Four out of seven were vulnerable to indirect prompt injection, including ChatGPT Atlas. The attacks bypassed the same-origin policy entirely.\n\nThis isn't theoretical. OWASP flagged memory poisoning in December 2025. Now there's concrete evidence of how it works in practice.\n\nIf you're running an AI agent with persistent memory, this is your threat model. What goes into memory matters. What gets trusted matters more.",
"sig": "ebb0825cc5c49247b78b4dfc1a4858ed7afbeb514aba99e649880744726a8c3f6adeac88370b64bc39b34bc92697a7759287c4925bf871d9e94a1d1c5baca311"
}
