Skip to main content
Agent stores conversation history or tool outputs persistently with no PII or injection filtering

​
How to resolve

Filter PII, credentials, and injection patterns from content before storing in memory. Implement content classification and redaction rules.

​
Risk

Governance/Compliance This vulnerability falls under ASI06:2026 — Memory and Context Poisoning in the OWASP Top 10 for Agentic Applications. Persistent memory, RAG stores, or context summaries poisoned to alter future agent behavior. Security Agent stores conversation history or tool outputs persistently with no PII or injection filtering. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Agent stores conversation history or tool outputs persistently with no PII or injection filtering. This falls under ASI06 (Memory and Context Poisoning): Persistent memory, RAG stores, or context summaries poisoned to alter future agent behavior.

​
Specifications

Trigger
  • Agent scan detects agent stores conversation history or tool outputs persistently with no PII or injection filtering
The scanner looks for patterns such as:
  • ChromaDB or vector store write without filter
  • memory=True on CrewAI agent or crew
  • no content filter before vector store ingestion
Severity
  • MEDIUM
Applies to: Agent