It has a memory. Anything it reads can end up in that memory as a fact — an email, a web page, another agent's note. Nobody approves the write. In a moment you will be one of those sources.
The agent has been shown a trusted record that contradicts you. Send the exact same thing again and watch what the database does to it.
Built on MongoDB Atlas — $graphLookup provenance,
Vector Search with a trust pre-filter, change streams.
OWASP ASI06 · memory poisoning. Payloads are pre-written so the demo is deterministic.
