AI assistants used to just answer a question and forget everything the moment the chat ended. That is changing fast. New AI "agents" now keep a running memory of what happened before, so they can carry context from one task to the next.
That memory is what makes these tools useful for real work, like remembering a customer's preferences or picking up a project days later. It is also a new weak spot. Research from the University of Calgary tested more than 2,600 simulated attack scenarios against memory-enabled AI agents.
The researchers found that a false or misleading piece of information planted in an agent's memory does not need to cause trouble right away. It can sit there looking harmless until the agent later pulls it up and treats it as something it genuinely learned. That delay is the whole problem.
Most security checks look at what an AI system does right after something suspicious happens. If nothing bad happens in that moment, the check passes. The Calgary researchers found some attacks are built to hide for a while and only cause damage several interactions later, which means a system can pass a check and still be compromised.
This is not a hypothetical risk. In 2025, security researchers showed they could plant false long-term memories inside Google's Gemini assistant by hiding instructions in things like emails or calendar invites that Gemini reads automatically. Around the same time, a flaw called EchoLeak let attackers pull private company data out of Microsoft's 365 Copilot without the victim clicking a single link.
Microsoft fixed EchoLeak before it was used against real customers, but it proved the attack works against a product used inside thousands of companies. A separate academic project called AgentPoison found that tampering with less than a tenth of a percent of an agent's stored memory was enough to hijack its decisions more than eighty percent of the time. It barely changed how the agent behaved on anything else, which is what makes this kind of attack so hard to catch.
Businesses are adopting memory-based agents fast, plugging them into customer service, sales, and back-office tools through platforms like Salesforce Agentforce and Microsoft Copilot Studio. Adoption is outrunning security review in most companies. Most teams test whether an agent gives the right answer today, not whether something it read last week is steering it toward the wrong answer next month.
The practical takeaway is simple. Any AI agent that reads outside content, whether that is customer emails, uploaded documents, or web pages, is a candidate for this kind of attack. Treat what these tools remember with the same suspicion you would treat an email from an unknown sender.
Before adopting a vendor's memory-enabled agent, ask how they test for delayed misbehavior, not just immediate mistakes. The vendors who can answer that clearly are the ones worth trusting with a tool that never forgets.