## Summary

OWASP recently published the **Top 10 for Agentic Applications**, which includes **ASI06: Memory Poisoning** — a threat specific to AI agents that persist memory across sessions.

LiteLLM is increasingly used as the backbone for multi-agent deployments. When agents built on LiteLLM persist conversation history or session state, they become vulnerable to memory poisoning attacks where malicious inputs get stored as "trusted" context, influencing future LLM calls.

## The threat

When an agent's memory/context is persisted (conversation history, retrieved context, tool outputs), a malicious actor can craft inputs that get stored as "trusted" memories. Those poisoned memories then influence future LLM calls — causing data leakage, unauthorized actions, or persistent manipulation across sessions.

This is OWASP ASI06: Memory Poisoning, formally recognized in the OWASP Top 10 for Agentic Applications.

## Proposed integration

The OWASP reference implementation for ASI06 is [agent-memory-guard](https://github.com/OWASP/www-project-agent-memory-guard) (Apache-2.0, pure Python, zero external dependencies):

pip install agent-memory-guard

**Suggested integration points for Lit…