I think persistent memory makes prompt injection much worse

Most prompt-injection examples I see end when the current run ends. That's not the version that worries me most. Once an agent has persistent project memory, a hostile README, ticket, or tool response can be summarized and stored. Three sessions later it may come back as “known project context” after the original source has disappeared from view. The bad instruction has effectively been laundered into memory. The design I'm working through treats context as more than text. Each item keeps its source, version, authority, and where it came from. A README can be relevant without becoming policy. A newer chat note doesn't automatically outrank a stable contract. Replaced information can remain in history without being used for new work. That still doesn't solve prompt injection. A model can be influenced by an untrusted source even when the label is correct. Any real external action still needs a separate authorization check that retrieved context can't rewrite. I don't have benchmark results for this yet. The next step is testing whether poisoned context survives retrieval, summarization, and consolidation across multiple sessions. Has anyone tested prompt injection over that longer lifecycle? Most evaluations I have found seem to stop before the poisoned context has a chance to become institutional memory.