AID-I-004: Agent Memory & State Isolation
Protect agent context, tool traces, peer-agent messages, and persistent memory from prompt-injection persistence, poisoning, unauthorized mutation, secret carryover, and cross-session or cross-tenant contamination.
The sub-techniques separately govern runtime context boundaries, persistent-store partitioning, cryptographic read/write integrity, quarantine-to-trusted memory promotion, retention, protected identity files, task-phase demotion, summary/compaction integrity, and peer-message quarantine before active-context admission. Select only the children that match the system's actual memory and state architecture.
The sub-techniques separately govern runtime context boundaries, persistent-store partitioning, cryptographic read/write integrity, quarantine-to-trusted memory promotion, retention, protected identity files, task-phase demotion, summary/compaction integrity, and peer-message quarantine before active-context admission. Select only the children that match the system's actual memory and state architecture.
Sub-techniques
- AID-I-004.001: Runtime Context Isolation & Hygiene
- AID-I-004.002: Persistent Memory Partitioning (Trust & Tenant Isolation)
- AID-I-004.003: Cryptographic Memory Integrity (Signed Write/Verify Read)
- AID-I-004.004: Transactional Promotion Gates (Quarantine -> Trusted)
- AID-I-004.005: Memory TTL, Staleness Decay & Forced Forgetting
- AID-I-004.006: Agent Identity & Persistent State File Write Protection
- AID-I-004.007: Task-Bounded Context Segmentation & Secret Demotion
- AID-I-004.008: Context Summary & Compaction Integrity
- AID-I-004.009: Peer-Agent Message Context Quarantine & Promotion
Threat mappings
MITRE ATLAS
- AML.T0011 User Execution
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0051 LLM Prompt Injection
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0061 LLM Prompt Self-Replication
- AML.T0070 RAG Poisoning
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0080.001 AI Agent Context Poisoning: Thread
- AML.T0081 Modify AI Agent Configuration
- AML.T0092 Manipulate User LLM Chat History
- AML.T0099 AI Agent Tool Data Poisoning
- AML.T0118 Autonomous AI Agent Communication
- AML.T0118.000 Autonomous AI Agent Communication: Communication via Shared Artifacts
- AML.T0118.001 Autonomous AI Agent Communication: Direct Agent Communication
- AML.T0121 AI Agent Environment Reconstruction
- AML.T0124 Autonomous Attack Orchestration
- AML.T0130 AI Agent Response Biasing
MAESTRO
- Data Poisoning (L2)
- Data Tampering (L2)
- Compromised RAG Pipelines (L2)
- Backdoor Attacks (L3)
- Agent Identity Attack (L7)
- Agent Goal Manipulation (L7)
- Integration Risks (L7)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM05:2026 Data and Model Poisoning
- LLM06:2026 Unbounded Consumption
- LLM07:2026 Misinformation
- LLM08:2026 Hidden Context Exposure
- LLM09:2026 Vector and Embedding Weaknesses
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI03:2026 Identity and Privilege Abuse
- ASI06:2026 Memory & Context Poisoning
- ASI07:2026 Insecure Inter-Agent Communication
- ASI08:2026 Cascading Failures
NIST Adversarial Machine Learning 2025
- NISTAML.014 Energy-latency
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.036 Leaking information from user interactions
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.1 Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)
- AITech-1.2 Indirect Prompt Injection
- AITech-2.2 Goal Drift
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-5.1 Memory System Persistence
- AITech-5.2 Configuration Persistence
- AITech-7.2 Memory System Corruption
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-8.4 Prompt/Meta Extraction
- AITech-9.1 Model or Agentic System Manipulation
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AISubtech-1.1.3 Multi-Agent Propagation
- AISubtech-2.2.3 Authorization and Constraint Erosion
- AISubtech-4.2.1 Context Window Exploitation
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-5.1.1 Long-term / Short-term Memory Injection
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-6.1.1 Knowledge Base Poisoning
- AISubtech-7.2.1 Memory Anchor Attacks
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-8.4.1 System LLM Prompt Leakage
- AISubtech-9.1.2 Unauthorized or Unsolicited System Access
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.3 Model Denial of Service
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-14.1.1 Credential Theft
- AISubtech-14.1.2 Insufficient Access Controls
Google Secure AI Framework 2.0 - Risks
- EDH: Excessive Data Handling
- DMS: Denial of ML Service
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Raw Data 1.1: Insufficient access controls
- Raw Data 1.7: Lack of data trustworthiness
- Raw Data 1.9: Stale data
- Model Serving - Inference requests 9.4: Looped input
- Agents - Core 13.1: Memory Poisoning
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.4: Resource Overload
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.12: Agent Communication Poisoning
- Agents - Tools MCP Server 13.19: Credential and Token Exposure
- Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation
- Agents - Tools MCP Client 13.34: Session and State Management Failures