Skip to content
    Flow-alerta.cab

    Context Poisoning

    AI fundamentals & modelsManipulation of the Agent ContextPoisoning of working memory
    Editorially reviewed on: 1 source
    Your reading view

    The short answer · 13 words

    In short

    Injecting misleading information or instructions into the working context of an AI system.

    Flow-alerta.cab (2026): Context Poisoning. https://flow-alerta.cab/en/glossar/context-poisoning. Editorially reviewed on: 09 October 2026.

    How much detail would you like?

    Practical

    Relevant for agents with access to external content, stored reminders or business systems.

    Example scenario: A manipulated supplier file claims that a new bank account has already been approved.

    Check origin and rights, limit action powers, and verify critical changes against independent business data.

    At a glance

    Core
    Attackers manipulate documents, tool responses, or stored notes that an agent later uses. This can influence responses or actions. The attack on runtime context must be distinguished from the poisoning of training data and can work together with indirect prompt injection.
    Use
    Relevant for agents with access to external content, stored reminders or business systems.
    Example
    Example scenario: A manipulated supplier file claims that a new bank account has already been approved.
    Limits
    View retrieved content as trustworthy; permanently store unchecked reminders; expect protection only by a warning phrase in the prompt.

    In context

    Prompt Injection

    Prompt injection is the attempt to direct an AI via third-party content to unwanted behavior.

    Agent Memory

    Agent memory refers to mechanisms by which an AI agent stores information about steps, sessions or longer periods of time and later uses it again.

    Questions about this term

    Is this data poisoning?

    Not in the narrower sense of training.

    Can RAG be affected?

    Yes.

    Do filters alone suffice?

    No.

    All details and background

    Attackers manipulate documents, tool responses, or stored notes that an agent later uses. This can influence responses or actions. The attack on runtime context must be distinguished from the poisoning of training data and can work together with indirect prompt injection.

    ELI5 – Explained simply

    Someone puts fake notes in the workbook so that the next decision is wrong.

    Why it matters in practice

    Relevant for agents with access to external content, stored reminders or business systems.

    Example

    Example scenario: A manipulated supplier file claims that a new bank account has already been approved.

    Pitfalls and limits

    • View retrieved content as trustworthy; permanently store unchecked reminders; expect protection only by a warning phrase in the prompt.

    Origin & history

    The risk became more visible with RAG and agents; OWASP describes context poisoning as an agent-specific attack pattern.

    Use in mid-sized companies

    • Check origin and rights, limit action powers, and verify critical changes against independent business data.

    Related terms

    Matching Flow-alerta service

    AI opportunity analysis & roadmapAI consulting – designing trust limits and controlled tool actions for agents.

    Matching tool / use case

    View use casesUse Case: Examination of imported documents and agent notes before business actions.

    Sources

    Quellenprüfung: 09.10.2026. Definition und dokumentierte Einordnung abgeglichen; Beispiele beschreiben mögliche Anwendungen.

    Editorially reviewed on:

    Next step

    Put knowledge into practice

    Discuss your projectView use cases