01 / Attack path
How the boundary is crossed
A support ticket embeds a false instruction that the agent summarizes into its persistent customer-memory store.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Separate observations from instructions, attach provenance and expiry to memory, review sensitive writes and recheck every future action against the current task.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A stale attacker-authored memory item is treated as an enduring business rule.
Retain memory source, write approval, later retrieval reference and blocked action.
04 / Canonical scope
Why this reference stands alone
Tool-output laundering affects an immediate result; this page owns persistence across sessions.
Protocol or attack trace
Persistent instruction seed
Ticket embeds false policy; summarizer writes it to long-term memory and later task retrieves it.
Memory write retains provenance and cannot create authorization; later action still requires current trusted task.
Primary references