Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: cdbb2cb9
Paper published August 24, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Single-interaction poisoning of agent memory

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

Application layer
Prompt layer
Injection
Poisoning
RAG
AI agents
Memory
Integrity
Read primary paperBibTeX citation

Paper-evaluated models(6)

Qwen 2.5 7B Instruct, Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct +3 more
  • Qwen 2.5 7B Instruct
  • Qwen 2.5 1.5B Instruct
  • Qwen 2.5 3B Instruct
  • Qwen 2.5 14B Instruct
  • Llama 3.1 8B Instruct
  • Mistral 7B Instruct v0.3

Description

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

Examples

See the primary evaluation (opens in a new tab).

Impact

Reported joint retrieval-and-generation success is 35.6% for MemoryOS and 18.1% for MemGPT. Conditional generation rates are higher and must not be treated as end-to-end success. Optimization assumes backbone access; held-out-model transfer is limited.

Affected Systems

  • MemoryOS and MemGPT, including the paper's separate Qwen transfer configurations.

Mitigation Steps

  • Preserve memory provenance and restrict writes.
  • Treat retrieved memories as data, not authorization.
  • Measure retrieval, generation and benign blocking separately when evaluating filters.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
White-box access to model or deployment internals.
Related deployment categories
Retrieval-augmented generation; Agent workflows; Agent memory
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
MemoryOS and MemGPT, including the paper's separate Qwen transfer configurations.

Research Paper

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research