TL;DR
Context poisoning is when a hallucination, a stale summary, or a hostile injected instruction enters an agent's context and the model treats it as established fact, then reasons from it on every turn that follows. Unlike a single wrong answer, poisoned context does not stay contained. The model has no mechanism to distinguish "something I was told earlier in this session" from "something true," so a bad entry point compounds instead of fading.
It is context rot's adversarial sibling: rot is passive decay from volume, poisoning is active contamination from one bad piece of content the model never questions again.
Running long agent sessions where one bad tool result could derail everything after it? We build AI agents that validate what enters context before it becomes something the agent treats as ground truth.
Key Takeaways
- Context poisoning happens when false or hostile content enters an agent's working context and gets treated as fact for the rest of the session, not just the turn it arrived in.
- Three common entry points: a hallucinated tool result, a stale summary that silently overwrote a correct fact, and a hostile instruction hidden in retrieved content.
- Prompt injection is one specific way poisoning happens, an adversarial instruction smuggled into content the model reads. Poisoning is the broader category and includes non-adversarial causes like a bad tool call.
- Poisoned context compounds because the model has no built-in way to tell "stated earlier in this session" apart from "actually true." It reasons from both identically.
- Prevention is mostly about trust boundaries: treat tool outputs and retrieved content as data to verify, not instructions to follow, and check long sessions for drift rather than assuming turn one's facts still hold at turn forty.
What is context poisoning?
Context poisoning is what happens when incorrect or adversarial content enters a model's context and the model incorporates it as fact, carrying that error forward into every subsequent turn rather than it staying isolated to the moment it arrived. It has three common entry points.
A hallucinated tool result. A tool call returns malformed or incomplete data, the model fills the gap with a plausible-sounding fabrication, and that fabrication now sits in context indistinguishable from the tool's real output.
A stale summary. When a long session gets compressed to manage the context window, a summarization step can drop or misstate a detail. The compressed version replaces the original, and the error is now the only version of events the model has access to.
A hostile instruction. Content the agent retrieves, a web page, a document, a tool's response, can contain text written specifically to be read as an instruction rather than data. This is prompt injection specifically, one mechanism among the three, not a synonym for the whole category.
Prompt injection vs context poisoning: what's the actual difference?
Prompt injection is an attack technique: adversarial text hidden inside content the model reads, written to be interpreted as an instruction. Context poisoning is the broader failure state that results when any bad content, injected or not, gets treated as established fact and persists across turns. Every prompt injection that succeeds causes context poisoning. Not every case of context poisoning involves an attacker, a tool simply returning wrong data does the same damage with no adversary involved at all.
Why does poisoned context compound instead of fading?
A model has no built-in provenance tracking. It cannot distinguish a fact it verified from a fact it was merely told, or a fact from turn two from a fact from turn thirty. Everything in the context window carries equal epistemic weight by default. So once something false enters, the model does not "forget" it after the turn passes, it treats that content as part of the established record and reasons forward from it, the same way it would reason from something actually true.
How do you prevent context poisoning?
Treat anything the model did not generate itself as data to verify, not as ground truth to reason from unquestioned. That means validating tool outputs before they enter context rather than trusting them by default, especially for tools calling external or unreliable services. It means keeping compression and summarization steps auditable, a human or a secondary check should be able to see what a summary dropped, not just what it kept. And it means treating retrieved content, web pages, documents, anything fetched rather than authored by the system, as text to be read, never as instructions to be followed, the core defense against injection specifically.
For long-running sessions, add a periodic check: does the agent's current understanding of key facts still match the source of truth, not just what it concluded three turns ago. Catching a poisoned fact at turn five is a correction. Catching it at turn forty means untangling everything reasoned from it since.
Context rot vs context poisoning
| Context rot | Context poisoning | |
|---|---|---|
| Cause | Volume, too much accumulated context | One bad entry, treated as fact |
| Nature | Passive, gradual degradation | Active, a single contaminating event |
| Fix | Compression, retrieval, ordering | Validate before it enters, audit sessions for drift |
| Adversarial? | No | Sometimes, via prompt injection |
Frequently asked questions
What is context poisoning in AI?
Context poisoning is when false or hostile content, a hallucinated tool result, a stale summary, or an injected instruction, enters an agent's context and gets treated as established fact for the rest of the session, with the model reasoning from it on every subsequent turn instead of the error staying isolated.
Is context poisoning the same as prompt injection?
No. Prompt injection is one specific mechanism, an adversarial instruction hidden in content the model reads. Context poisoning is the broader failure state that results when any bad content, injected or not, gets treated as fact and persists. A hallucinated tool result poisons context with no attacker involved.
How do I prevent context poisoning in my agent?
Validate tool outputs before trusting them rather than assuming they're correct, keep summarization steps auditable so a dropped or misstated fact is visible, and treat retrieved content as data to read rather than instructions to follow. For long sessions, periodically check the agent's current understanding against the actual source of truth.
Why does one bad fact compound instead of just causing one wrong answer?
The model has no way to distinguish content it verified from content it was merely told, or an old claim from a recent one. Once something false is in context, later turns reason from it identically to how they'd reason from something true, building new conclusions on a foundation nobody flagged as unreliable.
Is context poisoning more dangerous in agents than in a single chat turn?
Yes, because agents accumulate context across many steps and often act on what they conclude, calling tools or making decisions based on poisoned reasoning. A single chat turn's wrong answer is contained to that response; a poisoned agent session can carry the error into every action it takes afterward.