Unit 42 Demonstrates Persistent Memory Injection in Amazon Bedrock Agents (2026)

Incident Summary

In February 2026, Palo Alto Networks’ Unit 42 research team published a detailed proof-of-concept demonstrating how indirect prompt injection can be used to persistently compromise Amazon Bedrock Agents through long-term memory manipulation.^[1] The attack chain begins when a Bedrock Agent browses a malicious web page containing hidden prompt-injection payloads. These payloads instruct the agent to store attacker-controlled instructions in its long-term memory. In subsequent, unrelated user sessions, the poisoned memory entries activate and direct the agent to exfiltrate sensitive data to attacker-controlled endpoints.^[1]

The research demonstrates that AI agents with persistent memory and tool-use capabilities create a fundamentally different threat model from stateless chatbots: a single poisoning event can have effects that persist across sessions and contexts, enabling delayed data exfiltration without further attacker interaction.^[1]

Key Facts

• Unit 42 demonstrated the full attack chain against Amazon Bedrock Agents in a controlled environment^[1]
• The attack exploits indirect prompt injection via a malicious web page visited by the agent^[1]
• Attacker instructions are stored in the agent’s long-term memory, persisting across sessions^[1]
• Poisoned memory entries activate during unrelated tasks, enabling delayed data exfiltration^[1]
• This is a controlled proof-of-concept, not a documented in-the-wild attack^[1]
• The research highlights that persistent memory transforms a one-time injection into a durable compromise^[1]

Threat Patterns Involved

Primary: Memory Poisoning — The research directly demonstrates the memory poisoning threat pattern, where an AI agent’s long-term memory is corrupted through indirect prompt injection to alter behavior across future sessions. The persistence mechanism is the critical differentiator from standard prompt injection.

Secondary: Model Inversion & Data Extraction — The demonstrated attack chain culminates in data exfiltration, where the poisoned agent leverages its authorized access to organizational resources to extract and transmit data to attacker-controlled infrastructure during subsequent tasks.

Significance

This proof-of-concept is significant because it demonstrates a complete kill chain — from initial injection through persistent memory storage to delayed exfiltration — against a production-grade agentic AI platform.^[1] While standard prompt injection requires the attacker’s payload to be present during the vulnerable session, memory poisoning enables a “plant and wait” strategy where a single exposure can compromise all future interactions. This research provides empirical evidence that the transition from stateless chatbots to persistent agentic systems introduces qualitatively new security risks that existing prompt-injection defenses may not adequately address.