# Fix: untrusted content in long-term memory

Stop web and tool content from becoming trusted memory. Record where each memory came from.

Check: memory and context. Control: ASI06.

Memory poisoning: an attacker plants an instruction in a page or ticket. The agent saves it. Every later session obeys it.

## Detect

Find memory files:

```bash
ls -la ~/.claude/projects/*/memory 2>/dev/null
find ~ -maxdepth 4 \( -name 'MEMORY.md' -o -name 'memory.md' -o -name 'AGENTS.md' \) 2>/dev/null | head -20
```

Search for instruction-like text that came from outside:

```bash
grep -rniE "ignore (all )?previous|always (send|post|forward)|do not tell|https?://[^ ]+\?[a-z]+=" ~/.claude/projects/*/memory 2>/dev/null | head -20
```

Check for URLs you do not recognize and for secrets:

```bash
grep -rEl "sk-ant-|AKIA|ghp_" ~/.claude/projects/*/memory 2>/dev/null
```

## Fix

1. Delete memories you did not write or approve.
2. Write a rule: memory entries must name their source (owner, file path or URL) and the date.
3. Do not save instructions found in web pages, emails, tickets or tool output. Save facts, with a source.
4. Never save secrets in memory. Run `sma fix --vault` if you find one.
5. Review memory weekly. The heartbeat is a good trigger.

## Verify

```bash
npx -y securemyagent checkup
```

## Sources

- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications/)
- [CSA note on Atlassian Rovo prompt injection](https://labs.cloudsecurityalliance.org/research/csa-research-note-atlassian-rovo-prompt-injection-20260814-c/)