AI agent memory can be poisoned – and later treated as the user's own past