Cross-Session Memory Poisoning of AI Agents in Connected-Vehicle Security: Write-Time Filtering Costs Adaptation Under Concept Drift

Persistent AI agents increasingly triage security alerts by retrieving precedents from earlier sessions. This creates an attack surface separated in time from its effect: an adversary writing a few false precedents alters a later decision while being absent when it occurs. Defences screen new memory at write time, rejecting entries that contradict what is stored, and are reported as highly effective. Existing assessments hold the correct answer fixed, so any contradicting assertion is adversarial by construction. Real environments are not stationary, and when the world legitimately changes, a correct update and a poisoning attempt are indistinguishable on content alone: rejecting contradiction also rejects learning. We evaluate defences on real vehicle traffic, where a fleet refresh shifts the alert distribution, and a synthetic control, where the correct label itself changes. Write-time screening is effective and free when the environment is fixed yet substantially impairs adaptation under both kinds of change. Provisional trust, which admits new records at reduced influence until outcomes corroborate them, recovers more safety without a detectable adaptation cost; on a language model agent, its gain is significant with frozen memory but not with persistent memory. Ablation credits the provisional weighting. Memory defences cannot be assessed in a stationary setting.