Step four of a twenty-step agent run retrieves a document. The document is out of date — it describes a pricing structure that was replaced eight months ago. Nothing flags this; it is a real document from your real corpus that simply was not archived.
The agent now believes the old pricing. Step five reasons from it. Step nine builds a comparison on it. Step fourteen produces a recommendation, cites its own earlier reasoning, and reads as thoroughly researched. Every subsequent step made the answer more confident and none of them made it more correct.
What changed in 2026
- Longer runs made compounding worse. Agents doing twenty or fifty steps give a bad fact many more opportunities to propagate than a single-turn assistant did.
- Provenance tracking became a design requirement. Tagging facts with their source moved from a nice-to-have to the main practical mitigation.
- Memory made it persistent. Agents that write conclusions to durable memory can carry a poisoned fact across sessions, long after the run that introduced it.
- The distinction from data poisoning got clearer. Security discussion separated training-time attacks on model weights from inference-time contamination of context.
Not the same as data poisoning
Worth being precise, because the terms get used interchangeably and the defences are entirely different.
Data poisoning corrupts training data so the resulting model has a flaw baked in. It targets the weights, requires access to the training pipeline, and is a supply-chain problem — see data poisoning explained.
Context poisoning puts a wrong fact into the context window at inference time. The model is unchanged and behaving correctly; it is reasoning faithfully from bad input. It requires no special access at all, and frequently no attacker — a stale document does it by accident.
That last point matters most. The common case is not adversarial. It is an outdated wiki page, a tool returning a cached value, or a retrieval surfacing a draft. Framing this purely as a security issue misses that it happens constantly without anyone trying.
How it enters
| Entry point |
Typical cause |
Adversarial? |
| Retrieved document |
Stale, draft, or wrong content in the corpus |
Usually not |
| Tool result |
Cached, misconfigured, or failing silently |
Usually not |
| Web content |
Anything the agent fetched |
Can be |
| Subagent output |
A worker's mistaken conclusion |
No |
| Persisted memory |
A wrong fact written in an earlier run |
No |
| User input |
Deliberate misdirection |
Sometimes |
The subagent row deserves attention in fan-out architectures. A worker returning a confident wrong summary hands the orchestrator a fact with no indication it is unverified, and the orchestrator has no access to the source material to check — see subagent architecture.
The memory row is the most damaging because it outlives the run. An agent that writes "the customer is on the Enterprise plan" to memory after a bad retrieval will act on that in every future session until something corrects it.
Limiting the blast radius
Track provenance. Every fact entering the context should carry where it came from — which document, which tool call, which timestamp. This does not prevent poisoning and it makes a wrong conclusion traceable, which is the difference between a fixable error and a mystery. It also lets the agent weigh sources, and lets a reviewer check the chain.
Timestamp everything retrieved. A large share of accidental poisoning is staleness. Surfacing a document's age in the context lets the model discount old material, and lets you find corpus hygiene problems.
Prefer verification over accumulation for high-stakes facts. If a conclusion depends on a specific value, having the agent re-check it against a source of truth costs one call and prevents a compounding error.
Isolate rather than share. Independent subagents each working from primary sources are more robust than a chain where each step inherits the last one's conclusions. Contamination in one branch does not spread to the others.
Gate what reaches memory. Writing to durable memory should be a deliberate, narrow action — ideally facts the agent verified rather than inferred. An agent that persists everything it concluded will persist its mistakes.
Watch confidence carefully. A long run's later steps read as authoritative because they cite accumulated reasoning. That accumulation is not evidence. Reviewing an agent's final answer means checking its sources, not its self-consistency.
Common mistakes
- No provenance. A wrong conclusion with no traceable origin cannot be diagnosed.
- Treating retrieval as ground truth. Your corpus contains stale and draft material.
- Silent tool failures. A tool returning a default or cached value on error injects a plausible wrong fact.
- Persisting inferences to memory. Conclusions are not facts; storing them makes errors durable.
- Trusting later steps more. Confidence and accuracy diverge as a run gets longer.
- Chaining subagents. Each hop inherits the previous one's errors without the source material.
- No corpus hygiene. Archiving outdated documents prevents more poisoning than any runtime defence.
FAQ
Is this the same as hallucination?
No, and the distinction matters for the fix. A hallucination is the model inventing something. Context poisoning is the model correctly using something wrong that it was given. The remedy for one is grounding; the remedy for the other is better inputs and provenance.
Can an attacker cause this deliberately?
Yes — placing content where an agent will retrieve or fetch it is the mechanism, which overlaps heavily with prompt injection. The difference is that injection carries instructions and poisoning carries false facts.
How do I detect it?
Provenance plus review. If your traces show which source each claim came from, a wrong output is traceable to a bad input in minutes. Without it you are re-running and guessing — see AI agent observability.
Does a longer context window help?
Not really, and it can hurt. More context means more opportunity for something wrong to be included, and attention across a very long context is uneven, so a wrong early fact may outweigh a correct later correction.
Where to go next
For the training-time counterpart, read data poisoning explained. For the traces that make contamination diagnosable, AI agent observability, and for keeping bad conclusions out of durable storage, agent memory consolidation.