---
id: owasp-asi06-memory-context-poisoning
track: coding
version: 0.0.2
label: advisory
keyword: advise
where: text
sha256: b422e8230f82a9a450fddc5eae635d4b0ddcc2bd078d65d2248bdc1395d9890a
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi06-memory-context-poisoning
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI06 — Memory & Context Poisoning

owasp-asi06-memory-context-poisoning · version 0.0.2

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Stop untrusted content from being written into an agent's durable memory or retrieval index, where it silently steers behaviour in later sessions. Keep context ephemeral by default, validate and attribute every memory write, scope memory per user and per task, and let operators inspect and flush it. Use when adding long-term memory, a vector index, session summarisation, or user preference storage. Do NOT use for the coding agent's own memory files — that is \`memory-discipline\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi06-memory-context-poisoning
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi06-memory-context-poisoning
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi06-memory-context-poisoning
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi06-memory-context-poisoning
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi06-memory-context-poisoning
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi06-memory-context-poisoning
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi06-memory-context-poisoning
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi06-memory-context-poisoning
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi06-memory-context-poisoning
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi06-memory-context-poisoning
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi06-memory-context-poisoning

## What it misses

This policy does not state what it misses.

## Latest change

0.0.2 · 2026-08-16 — Add compliance claims (mitre_atlas); no mechanism change.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `b422e8230f82a9a450fddc5eae635d4b0ddcc2bd078d65d2248bdc1395d9890a`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi06-memory-context-poisoning (catalog path `agentic-security/owasp-asi06-memory-context-poisoning`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi06-memory-context-poisoning.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi06-memory-context-poisoning&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fowasp-asi06-memory-context-poisoning%2F