Definition
Context poisoning is the deliberate or accidental corruption of information an AI system carries into later decisions. The poisoned material might be a false fact in a retrieved document, an instruction hidden in a tool result, a fabricated preference saved to memory, or an incorrect status written into a long-running task.
The danger grows when context persists. One bad entry can be retrieved repeatedly, copied into summaries, or used to justify new actions. What began as a single untrusted claim can become part of the system's working state.
Useful defenses treat context as attributed, mutable data. Record where an item came from, when it was observed, which process changed it, and how strongly it should be trusted. Give operators a way to correct or delete it, and expire state that no longer has a reason to persist.
Distinguish it from nearby terms
Context poisoning targets runtime or stored context. Data poisoning is the broader attack on data used for training, tuning, retrieval, memory, or evaluation. Model poisoning changes model weights or artifacts. Prompt injection is one way to poison context, but context can also be corrupted by false facts or stale state that contain no instruction at all.
Check your understanding
An agent saves a support ticket's false account number to customer memory, then uses it in three later workflows. This is context poisoning even if the original ticket contained no malicious prompt. The fix starts with provenance, correction, and removal of the contaminated state.