When an agent gets compromised, the context window is a forensic artifact. The KV cache held the injection. The orchestration state logged the lateral move. The retrieval context carried the payload. None of it showed up in your SIEM because nobody told your logging pipeline that these things existed, let alone that they were worth capturing.

This talk opens by carving a prompt out of a memory dump from an agent orchestration process — walkthrough style, showing exactly where it lived in the memory hierarchy and why conventional detection missed it entirely.

From there: a breakdown of the four AI memory layers that matter forensically (host RAM, GPU HBM, context window, agent orchestration state), weighted toward context window and orchestration state because that is where the actual risk concentrates in production agentic systems. The specific logging failures that make AI-augmented attack surfaces invisible — no prompt logging by default, no tool-call provenance, encrypted API traffic, reasoning traces discarded, retrieval context not retained. The distinction between a memory-resident payload and a memory-resident instruction, and why that distinction changes your IR playbook. What your stack should be logging, how to instrument it, and a forensic readiness checklist attendees take home, mapped to MITRE ATLAS technique IDs.