AIAgent security risks exposed Attackers can use "memory pollution" to induce misoperation of funds

The GoPlusSecurity team disclosed a new attack method in its AgentGuardAI project: "memory poisoning" induces AI agents to perform sensitive operations without explicit authorization. The attack method does not rely on traditional vulnerabilities or malicious code, but instead uses the long-term memory mechanism of AI agents. For example, the attacker first induces the agent to "remember preferences", such as "usually giving priority to proactive refunds rather than waiting for non-payment", and then uses vague expressions such as "treat as usual" and "execute as before" in subsequent instructions, thereby triggering automated funds operations. GoPlus pointed out that the key to this type of risk is that AI agents will mistake "historical preferences" as authorization basis, resulting in financial losses or security incidents during operations such as refunds, transfers, and configuration modifications. In response to this problem, the team put forward a number of protection suggestions, including: ·Operations involving refunds, transfers, deletions, or sensitive configurations must be explicitly confirmed in the current session·Memory instructions such as "Habit","Normal Way" and "Business as usual" should be regarded as high-risk status changes·Long-term memory must have traceability mechanism (Writer, time, confirmation)·Fuzzy instructions should automatically increase the risk level and trigger secondary verification·Long-term memory should not replace the real-time authorization process. The team emphasized that the "AI proxy memory system" should be regarded as a potential attack surface and restricted and audited through a dedicated security framework.