Definition
Many AI agents save their running state — tools, conversation, temporary files — so they can resume later. If an attacker can tamper with that saved state, restoring it can silently overwrite files or inject false data into the agent's next run.
Why it matters
Agents increasingly persist state in shared repositories such as Git, which puts that state under outside influence. A poisoned state turns an agent's routine resume into an attack on everything it touches.