Memory poisoning: the one injection that never leaves

Most prompt-injection discussions assume a single bad turn: a poisoned web page or document slips an instruction into the model's context, the model does something it shouldn't, and the session ends. Clear the context and the problem is gone. Persistent memory breaks that assumption. The whole point of agent memory is that things written in one session survive into the next. So if an injected instruction gets written into memory, it doesn't end with the session — it re-enters the context every…