Cumulative Context Poisoning

When an attacker plants instruction fragments during an interaction days earlier, and the system's persistent memory retains them; due to unmitigated control gaps, the attack activates when conditions are met, while the current conversation appears entirely normal, making it difficult to associate with the earlier interaction during investigation, triggering compliance exposure and operational reputational costs.