OWASP speakers: AI memory can turn a one-off prompt injection into a lasting backdoor

A speaker on the OWASP Foundation show argued that AI memory can turn prompt injection from a passing trick into a lasting backdoor. Prompt injection means hiding instructions in text so an AI obeys them. The guests were Rico Komenda and Barno Kaharova.

What was said

A speaker described the old problem first. Prompt injection lived in one chat window, and closing the window ended the attack. Memory changed that, because models now keep context to recall later. The speaker said such payloads are hard to log. Spotting one small trigger in long conversations is difficult.

The speakers then listed four attacks they would show. The first poisons a retrieval system, which lets a model look up stored documents, so the whole knowledge base is tainted. The second poisons the context and the summary of what a chatbot can do. The third uses triggers. The fourth spreads poison through a multi-agent system. One speaker said a planted payload can fire about four months later, because attackers take their time. In a banking chatbot demo, a speaker said the backdoor fired and a payment reached their own corporation.

On spread, a speaker said agents in a multi-agent system probably share memory and trust each other, so one compromise can reach many. In the demo, an assistant named Aria read a Confluence page, which is a company wiki page. A speaker explained the failure: "Because it trusted the page once, but doesn't verify it again." A speaker also put the stakes plainly: "AI agents are only as trustworthy as what they remember."

Why it matters

Our reading goes beyond the demos the excerpts cover, so take it as an inference. In the Confluence case, the agent trusted a page once and never checked it again. If the other attacks work the same way, a memory write is an input. It would then need the checks untrusted input gets: what may be stored, who wrote it, and whether it is rechecked when read. The speakers did not put it this way.

Shared memory raises the stakes, because one bad write could reach every agent that reads it. A speaker noted that an AI security standard they helped with once assumed the first agent's output was verified and trustworthy. That was fixed, but it had been the default. Buyers can ask vendors what their agents remember and who can write to it.

The other side

These were demos the presenters built, so they show what is possible, not how common it is. The excerpts also skip most of the demos, so we cannot check how each attack entered memory. A speaker said that in their own penetration tests at Adesso, 80% of it worked. The excerpts do not say how success was counted.

The excerpts also skip the defence section, which the hosts said Rico would cover later. One speaker said only that layered defence matters more than ever, and that patching code will not fix this. Another said vendors often shift responsibility to the developer. Who pays when a poisoned memory moves money stays open.