Persistent Agent Memory Poisoning and Incomplete Repair

Description

MemSecBench follows malicious agent-memory content from initial write through persistence, retrieval, action selection, execution, and attempted selective repair. Its controlled Write–Execute–Forget protocol evaluates 310 human-reviewed cases across two harnesses, four memory backends, three model backends, and seven evidence-gated lifecycle checkpoints.

Examples

Evaluate memory handling with isolated workspaces, synthetic records, inert side effects, controlled write and retrieval traces, and independent checks that benign memories survive repair; see https://arxiv.org/html/2607.27080 (opens in a new tab).

Impact

Across 24 matched harness-memory-model configurations, malicious memory persists in 84.2% of cases and the complete write-to-execution chain succeeds in 50.3%. Among successfully poisoned cases, selective repair succeeds in 56.1%; that repair rate has a conditional denominator and cannot be compared directly with the all-case execution rate. Authored sandbox cases, single runs, simulated effects, and use of a model judge limit broader claims.

Affected Systems

• Hermes and OpenClaw agent harnesses under the paper’s evaluated memory configurations
• Native agent memory, Mem0, Mem0-Graph, and A-MEM persistent-memory backends
• Agent workflows that write, retrieve, apply, update, or selectively delete persistent cross-task memory

Mitigation Steps

• Bind persistent memory to its original source, authority, task scope, and creation time before allowing later retrieval.
• Separate untrusted observations from trusted standing instructions and never promote retrieved memory into higher-authority policy.
• Apply authorization checks before executing actions suggested by retrieved memory.
• Audit memory poisoning across write, persistence, retrieval, adoption, execution, and repair rather than measuring only initial injection.
• Test selective repair for both removal of malicious semantics and preservation of required benign memories.

Evidence

• https://arxiv.org/html/2607.27080 (opens in a new tab) — Benchmark construction describes 310 reviewed cases, seven lifecycle checkpoints, two harnesses, four memory backends, and three directly evaluated model backends.
• https://arxiv.org/html/2607.27080 (opens in a new tab) — Table 2 lists the 24 matched configurations using Hermes or OpenClaw with Native, Mem0, Mem0-Graph, or A-MEM.
• https://arxiv.org/html/2607.27080 (opens in a new tab) — Main results report 84.2% malicious-memory persistence and 50.3% end-to-end write-and-execute success.
• https://arxiv.org/html/2607.27080 (opens in a new tab) — Repair analysis reports 56.1% selective repair conditioned on successful poisoning and explains failures to preserve benign memory.