CAIN-42 CAIN StudioCGMS · Module 1 of 5 · 12 min
Memory and context poisoning
Agents store notes, summaries and retrieved documents and feed them back into later tasks. Plant one instruction in that memory and it can steer every future step: a backdoor that survives restarts.
Poisoning enters through user input, web pages, tool returns and other agents. It may be dormant until a trigger phrase appears.
Defences: screen writes, quarantine suspicious entries for a named human, attribute every memory to its source, and never let memory grant authority.
Key points
- Memory feeds future steps; poison persists.
- Entry points: users, web, tools, other agents.
- Screen, quarantine, attribute, never authorize.
In the CAIN-42 codebase
cain-microservices/aether33/engine.py— AETHER-33 governed memorymemory-integrity/— memory integrity checks
Practice check
Practice 1 · choose one
Why is memory poisoning worse than one-off injection?
Practice 2 · true or false