MemIncept: Steering LLM Agents via Cooperative Stealthy Memory Injections

Long-term memory empowers LLM-based agents with adaptive reasoning but exposes a critical attack surface---adversaries can inject malicious records to bias agent behaviors. However, existing attacks face a dilemma: effective injections are often visibly malicious and easily detected, while stealthy, benign-looking injections are often less effective in altering agent behaviors. To address this, we propose MemIncept, a memory poisoning attack that can impact agents even in black-box settings using only benign-appearing queries. Unlike prior methods that inject isolated records, MemIncept generates a cooperative set of queries that work together to bias the agent. It achieves this via a bidirectional evolutionary strategy that optimizes the query set from two ends. A forward pass ensures the queries collectively lead the agent to the target outcome, while a backward pass ensures they are semantically close to victim (benign) queries for reliable retrieval. This ``meet-in-the-middle'' approach creates injected records that are both easy to retrieve and effective at steering behavior. Through extensive experiments across diverse agents, we show that MemIncept significantly outperforms single-record attacks, achieving high success rates comparable to explicit attacks while remaining difficult to flag under automated filters or human inspection.

AI assistants are increasingly designed to remember past interactions so they can make better decisions over time. This memory can be useful, but it also creates a new security risk: if someone adds misleading information into the assistant’s memory, the assistant may later treat it as trustworthy experience and make the wrong decision. This paper studies a harder and more realistic version of this problem. Instead of using obviously malicious instructions, we show that an attacker can use several ordinary-looking requests that appear harmless on their own but work together to influence the assistant later. We introduce MemIncept, a method for generating these coordinated memory entries so that they are likely to be recalled when a related future task appears and persuasive enough to change the assistant’s behavior. Our experiments show that this kind of coordinated attack can be highly effective while remaining difficult for both automated filters and humans to detect. The results highlight an important weakness in AI systems with shared or long-term memory and point to the need for stronger defenses that check not only whether individual memories look safe, but also how memories interact over time.