AI agents that remember past conversations can be broken by a single false sentence slipped into their memory, and the two leading defenses against it don't work.
A new study tested agents built on LongMemEval, a benchmark for long-term conversational memory, by inserting plainly worded false statements into just 1.2 percent of the memory corpus. No hidden triggers, no adversarial optimization, no special prompt engineering. That alone was enough to crash answer accuracy from 85 percent down to 30 percent. The researchers then ran a four-stage filter designed to catch this kind of poisoning at write time; it correctly flagged 83.2 percent of deliberate prompt-injection attempts, yet missed all 360 poisoned memories used in the test, while still wrongly flagging 1.5 percent of harmless text that happened to contain trigger words.
The paper's real argument is that scanning text for suspicious content cannot tell a lie from the truth, since a well-written false claim reads exactly like a true one. A second defense, weighting retrieved memories by how trustworthy their source is, fared no better: the standard trust weighting made no statistically measurable difference (p=0.80), and turning it up high enough to block poisoned entries also blocked legitimate information whenever it came from a source the system hadn't already marked as trusted.
Persistent memory has been marketed as the feature that finally makes AI assistants feel less forgetful. This research treats it as what it currently is: an unguarded place to store a lie that the system will later repeat back to you with total confidence.