{"post":{"slug":"context-poisoning-explained-2026","title":"Context Poisoning: When a Bad Fact Contaminates the Run","excerpt":"One wrong retrieved chunk or one bad tool result enters the context, and every subsequent step reasons from it. The agent gets more confident as it gets more wrong.","category":"ai","date":"August 15, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">S</span>tep four of a twenty-step agent run retrieves a document. The document is out of date — it describes a pricing structure that was replaced eight months ago. Nothing flags this; it is a real document from your real corpus that simply was not archived.\n\nThe agent now believes the old pricing. Step five reasons from it. Step nine builds a comparison on it. Step fourteen produces a recommendation, cites its own earlier reasoning, and reads as thoroughly researched. Every subsequent step made the answer more confident and none of them made it more correct.\n\n## What changed in 2026\n\n- **Longer runs made compounding worse.** Agents doing twenty or fifty steps give a bad fact many more opportunities to propagate than a single-turn assistant did.\n- **Provenance tracking became a design requirement.** Tagging facts with their source moved from a nice-to-have to the main practical mitigation.\n- **Memory made it persistent.** Agents that write conclusions to durable memory can carry a poisoned fact across sessions, long after the run that introduced it.\n- **The distinction from data poisoning got clearer.** Security discussion separated training-time attacks on model weights from inference-time contamination of context.\n\n## Not the same as data poisoning\n\nWorth being precise, because the terms get used interchangeably and the defences are entirely different.\n\n**Data poisoning** corrupts training data so the resulting model has a flaw baked in. It targets the weights, requires access to the training pipeline, and is a supply-chain problem — see [data poisoning explained](/blog/data-poisoning-explained-2026).\n\n**Context poisoning** puts a wrong fact into the context window at inference time. The model is unchanged and behaving correctly; it is reasoning faithfully from bad input. It requires no special access at all, and frequently no attacker — a stale document does it by accident.\n\nThat last point matters most. The common case is not adversarial. It is an outdated wiki page, a tool returning a cached value, or a retrieval surfacing a draft. Framing this purely as a security issue misses that it happens constantly without anyone trying.\n\n## How it enters\n\n| Entry point | Typical cause | Adversarial? |\n| --- | --- | --- |\n| Retrieved document | Stale, draft, or wrong content in the corpus | Usually not |\n| Tool result | Cached, misconfigured, or failing silently | Usually not |\n| Web content | Anything the agent fetched | Can be |\n| Subagent output | A worker's mistaken conclusion | No |\n| Persisted memory | A wrong fact written in an earlier run | No |\n| User input | Deliberate misdirection | Sometimes |\n\nThe subagent row deserves attention in fan-out architectures. A worker returning a confident wrong summary hands the orchestrator a fact with no indication it is unverified, and the orchestrator has no access to the source material to check — see [subagent architecture](/blog/subagent-architecture-explained-2026).\n\nThe memory row is the most damaging because it outlives the run. An agent that writes \"the customer is on the Enterprise plan\" to memory after a bad retrieval will act on that in every future session until something corrects it.\n\n## Limiting the blast radius\n\n**Track provenance.** Every fact entering the context should carry where it came from — which document, which tool call, which timestamp. This does not prevent poisoning and it makes a wrong conclusion traceable, which is the difference between a fixable error and a mystery. It also lets the agent weigh sources, and lets a reviewer check the chain.\n\n**Timestamp everything retrieved.** A large share of accidental poisoning is staleness. Surfacing a document's age in the context lets the model discount old material, and lets you find corpus hygiene problems.\n\n**Prefer verification over accumulation for high-stakes facts.** If a conclusion depends on a specific value, having the agent re-check it against a source of truth costs one call and prevents a compounding error.\n\n**Isolate rather than share.** Independent subagents each working from primary sources are more robust than a chain where each step inherits the last one's conclusions. Contamination in one branch does not spread to the others.\n\n**Gate what reaches memory.** Writing to durable memory should be a deliberate, narrow action — ideally facts the agent verified rather than inferred. An agent that persists everything it concluded will persist its mistakes.\n\n**Watch confidence carefully.** A long run's later steps read as authoritative because they cite accumulated reasoning. That accumulation is not evidence. Reviewing an agent's final answer means checking its sources, not its self-consistency.\n\n## Common mistakes\n\n- **No provenance.** A wrong conclusion with no traceable origin cannot be diagnosed.\n- **Treating retrieval as ground truth.** Your corpus contains stale and draft material.\n- **Silent tool failures.** A tool returning a default or cached value on error injects a plausible wrong fact.\n- **Persisting inferences to memory.** Conclusions are not facts; storing them makes errors durable.\n- **Trusting later steps more.** Confidence and accuracy diverge as a run gets longer.\n- **Chaining subagents.** Each hop inherits the previous one's errors without the source material.\n- **No corpus hygiene.** Archiving outdated documents prevents more poisoning than any runtime defence.\n\n## FAQ\n\n**Is this the same as hallucination?**\nNo, and the distinction matters for the fix. A hallucination is the model inventing something. Context poisoning is the model correctly using something wrong that it was given. The remedy for one is grounding; the remedy for the other is better inputs and provenance.\n\n**Can an attacker cause this deliberately?**\nYes — placing content where an agent will retrieve or fetch it is the mechanism, which overlaps heavily with [prompt injection](/blog/prompt-injection-defense-guide-2026). The difference is that injection carries instructions and poisoning carries false facts.\n\n**How do I detect it?**\nProvenance plus review. If your traces show which source each claim came from, a wrong output is traceable to a bad input in minutes. Without it you are re-running and guessing — see [AI agent observability](/blog/ai-agent-observability-2026).\n\n**Does a longer context window help?**\nNot really, and it can hurt. More context means more opportunity for something wrong to be included, and attention across a very long context is uneven, so a wrong early fact may outweigh a correct later correction.\n\n## Where to go next\n\nFor the training-time counterpart, read [data poisoning explained](/blog/data-poisoning-explained-2026). For the traces that make contamination diagnosable, [AI agent observability](/blog/ai-agent-observability-2026), and for keeping bad conclusions out of durable storage, [agent memory consolidation](/blog/agent-memory-consolidation-2026).","hue":219,"metaTitle":"Context Poisoning: When a Bad Fact Contaminates","metaDescription":"How one incorrect retrieved document or tool result contaminates an entire agent run, why it differs from training data poisoning, and how provenance limits it.","keywords":["context poisoning","agent contamination","bad retrieval propagation","inference time poisoning","agent error compounding","retrieval provenance","rag failure mode","agent reliability 2026"],"tldr":["**A wrong fact early compounds across every later step** — the agent builds on it, cites it, and grows more confident as it accumulates supporting reasoning.","**This is inference-time, unlike training data poisoning** — nothing about the model changed; its context did.","**Retrieved documents and tool results are the entry points** — anything the agent reads that it did not verify can carry the bad fact.","**Provenance is the main defence** — tag where each fact came from so a wrong one is traceable and challengeable.","**Skip:** trusting a long-running agent's later conclusions more because it has done more work. Confidence rises whether or not accuracy does."],"readTime":"5 min read","wordCount":1063},"related":[{"slug":"contextual-retrieval-explained-2026","title":"Contextual Retrieval: Giving Chunks Their Context Back","excerpt":"Splitting a document destroys the context each piece depended on. Prepending a short description of where a chunk came from fixes more retrieval failures than tuning chunk size.","category":"ai","date":"August 11, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":198},{"slug":"agent-replay-and-checkpoints-2026","title":"Agent Replay and Checkpoints: Resuming Instead of Restarting","excerpt":"An agent fails at step forty of fifty. Restarting means paying for forty steps again and hoping the non-deterministic parts land the same way. Checkpoints make that unnecessary.","category":"ai","date":"August 17, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":214},{"slug":"episodic-memory-ai-agents-2026","title":"Episodic Memory for Agents: Remembering Across Sessions","excerpt":"An agent that forgets everything between sessions repeats itself endlessly. Here is how to give it durable memory without turning the context into a landfill.","category":"ai","date":"August 14, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":214}],"sameCategory":[{"slug":"agent-cost-attribution-2026","title":"Agent Cost Attribution: Finding Where the Tokens Went","excerpt":"A single monthly API bill tells you that agents are expensive. It does not tell you which feature, which customer, or which retry loop is responsible. That gap is fixable.","category":"ai","date":"August 19, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":220},{"slug":"human-in-the-loop-agents-2026","title":"Human-in-the-Loop Agents: Where to Put the Approval Gate","excerpt":"Approve everything and the agent is a slow autocomplete. Approve nothing and you have handed irreversible actions to a system that can be talked into things.","category":"ai","date":"August 19, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":197},{"slug":"reasoning-effort-controls-2026","title":"Reasoning Effort Controls: Tuning How Hard a Model Thinks","excerpt":"Fixed thinking budgets gave way to effort levels, and the default is rarely the right setting. Here is how the dial behaves and where each level actually belongs.","category":"ai","date":"August 19, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":210},{"slug":"retrieval-metrics-explained-2026","title":"Retrieval Metrics: Measuring the Half of RAG That Fails","excerpt":"When a RAG system answers badly, the retrieval usually failed before the model ever spoke. Measuring generation quality alone hides that entirely.","category":"ai","date":"August 19, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":215}],"newer":{"slug":"ai-document-extraction-accuracy-2026","title":"AI Document Extraction: Measuring Accuracy Honestly","excerpt":"Vendors quote extraction accuracy without saying what they measured. Here is how to define the metric for your documents and what a realistic number looks like.","category":"ai","date":"August 15, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":215},"older":{"slug":"crypto-etf-options-explained-2026","title":"Crypto ETF Options Explained: Income and Real Risk","excerpt":"Listed options on crypto ETFs opened covered call and hedging strategies to ordinary brokerage accounts. Here is how they behave differently from equity options.","category":"finance","date":"August 15, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":300}}