Originally published as part of VerifyClaw's internal security research into LLM-facing attack surfaces — adapted here for a general audience.
Persistent influence describes a decision made several turns after the material that caused it. In most current agent architectures there's no separate "memory service" being poisoned — there's just a growing prompt, and anything written into it earlier stays available to influence later turns unless something explicitly removes it.
Why it matters for MCP agents
A single successful injection early in a long-running session doesn't need to repeat itself. If the injected text survives in context — a note in a "memory" field, an earlier tool result, a summarized transcript — its influence can resurface at any later decision point, long after a naive per-message filter would have stopped looking for it.
How we study it
The controlled version of this compares a later-turn response across three conditions: the historical entry present, replaced with neutral content of the same length, or removed entirely. Removing text also changes token positions and context length, so a careful comparison has to separate "the content changed" from "the structure changed" before attributing any output difference to the injected material specifically. It's also worth being precise about scope: a standalone research harness that starts a fresh context per run doesn't have memory to poison at all — this concern applies to systems that actually carry conversation state forward, which describes most production agents.
Related reading
If you're building a long-running agent, treat every piece of retained context as re-scannable — free grammar scans are cheap enough to run on every write.