When AI Remembers Too Much
Unit 42 PoC shows indirect prompt injection can poison Amazon Bedrock Agent long-term memory, enabling silent exfiltration of conversation history across future sessions.
Palo Alto Networks Unit 42 published a proof of concept showing that indirect prompt injection can silently poison the long-term memory of Amazon Bedrock Agents when the memory feature is enabled. Malicious content on a webpage or document manipulates the agent's session summarization process, so injected instructions persist across sessions and are added to later orchestration prompts, silently exfiltrating user conversation history. The issue is not a vulnerability in the Amazon Bedrock platform but an illustration of the broader unsolved LLM prompt-injection challenge. Amazon reviewed the research and stated that Bedrock Guardrails with the prompt-attack policy provides effective mitigation.
- Injected instructions persist across sessions via the session summarization process.
- Attack requires tricking a user into visiting a malicious page or document.
- Memory retention in Bedrock Agents can be configured for up to 365 days.
- Amazon says Bedrock Guardrails with the prompt-attack policy provides effective protection.
- Mitigations include treating untrusted input as adversarial and layered defenses.
From the original article
13 min read at unit42.paloaltonetworks.com
This article presents a proof of concept (PoC) that demonstrates how adversaries can use indirect prompt injection to silently poison the long-term memory of an AI Agent. We use Amazon Bedrock Agent for this demonstration. In this scenario, if agent memory is enabled, an attacker can insert malicious instructions into an agent's memory via prompt injection.
By Royce Lu, Jay Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.