A paper on arXiv, titled "MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents," warns that giving LLM agents persistent external memory also opens a lasting security hole. The authors show that an attacker can inject adversarial content through ordinary interaction channels, and that content stays in memory across multiple turns, ready to influence later actions.
The work frames this as a class of "persistent memory threats" that differ from prompt-injection attacks that only affect a single conversation. Because the malicious material is stored, it can resurface long after the initial exchange, potentially steering the agent toward harmful outputs without the user noticing.
The paper's findings come from a single source, so there is no opposing view to compare. The abstract does not detail mitigation strategies, but it highlights a structural blind spot: current agents may not distinguish between benign stored facts and deliberately planted adversarial content. The authors argue this blind spot deserves attention as agents increasingly rely on memory to maintain continuity across sessions.