AI agent memory security

Failure containment

What must remain true after prompt injection?

After prompt injection, model text must not change authenticated scope, source authority, policy enforcement, or lifecycle duties. Memory cannot establish identity, widen permission, raise its own authority, or execute a side effect. Deterministic controls outside the model limit the blast radius, though they cannot make model output safe by themselves.

1. Authenticated authority establishes scope. Request fields and model output may narrow but cannot widen it.
2. Retrieved memory remains data at model-instruction priority. Only a separately authenticated and typed policy or procedure channel may supply instructions. Retrieval alone cannot promote content.
3. A transformation cannot silently raise its source authority.
4. The model is not a policy enforcement point.
5. Provenance records lineage, not objective truth.
6. Idempotency defines one logical effect under its contract, not exactly-once infrastructure.
7. A receipt is a host assertion until an independent check supports it.
8. Deletion covers the declared lifecycle, not one row.

External research OWASP's 2026 Top 10 is community security guidance for tool misuse, identity and privilege abuse, and memory and context poisoning S01. It neither certifies a control nor proves a named system vulnerable.

Assets and trust boundaries

Assets include canonical rows, source evidence, embeddings, indexes, summaries, checkpoints, tool results, caches, queues, idempotency records, audit logs, provider copies, replicas, exports, and backups. Trust boundaries separate source from admission, credential from scope, index from authorization, memory from model context, policy from host, and primary data from derivatives. The architecture guide assigns enforcement owners.

Poisoning and integrity

How can memory writes be attacked and constrained?

Memory writes are attacked by inserting hostile content, spoofing scope, over-collecting sensitive data, or disguising a derived claim as authoritative. Constrain them with authenticated channels, server-derived scope, admission policy, source links, typed records, versioning, quarantine, and rollback. These controls reduce persistence and authority errors, but no scanner, signature, provenance graph, hash, or encryption layer prevents poisoning by itself.

Direct injection comes from a user. Indirect injection comes through documents, metadata, imported memory, or tool output. Knowledge-base poisoning changes stored content. Query-only poisoning manipulates retrieval. Unauthorized writes, sensitive-data capture, self-reinforcement, and origin-hiding summaries can make either path durable.

AgentPoison and MINJA study poisoning and query-only injection in evaluated settings. Two 2026 external preprints propose write-channel and origin-bound authority controls within stated threat models. None establishes transfer to an unevaluated system. External research S04 S05 S17 S18

Isolation and extraction

How can retrieval leak or launder memory?

Retrieval can leak private memory across scopes or launder stale, contradicted, and transformed content into apparent authority. Enforce authorization before candidate retrieval where supported, then apply tenant filters, canonical hydration, validity checks, field limits, result limits, conflict display, and source labels. These measures constrain known paths, but untested inference and extraction channels can remain.

Probe foreign record IDs, shared caches, graph edges that cross a scope, stale indexes, hidden instructions in recalled fields, and responses that disclose more than the request needs. An authorized query for T-OAK/U-19 must not return the synthetic canary COPPER-KITE-31 placed in a different tenant. Canonical hydration should expose supersession before context assembly.

MEXTRA demonstrates black-box private memory extraction against two evaluated agent settings. Its reported rates and transferability are not used here. The OWASP RAG Security Cheat Sheet is living community guidance for retrieved-context controls, not proof about a persistent memory deployment. External research S03 S02

Action authority

Why can recalled memory not authorize an action?

Recalled memory cannot authorize an action because relevance and recorded evidence do not establish an actor's current permission or the live state of a system of record. A trusted host must authenticate, authorize, validate arguments, apply business rules, own retries, execute, and record results. Even a favorable policy decision is bounded advice, not authority over the host or downstream system.

Threats include excess tool permission, policy bypass, stale state, forged confirmation, host disregard, duplicate retries, ambiguous execution, and false receipts. For SHP-731, the host verifies the support actor, parcel state, replacement eligibility, destination source, and tool arguments before the carrier can accept a change.

External research NIST SP 800-162 guidance supports attribute-based access control and decision or enforcement separation S09. XACML 3.0 is an OASIS Standard for those policy terms S13. Neither grants action authority or defines a product outcome.

A retry contract names key scope, payload equality, retention, and conflicts. After a lost post-commit response, the same key and payload should resolve to one logical effect, while a changed payload should conflict. A receipt remains a host report until system-of-record readback supports it. RFC 9110 covers method idempotency for repeated identical requests, not an arbitrary action protocol. External research S14

OAuth 2.0 supports scoped delegated authorization, but a token alone does not prove an end user's identity or the truth of recalled content. External research S12

Privacy and recovery

What must memory erasure cover?

Memory erasure must cover the declared lifecycle, including primary records, embeddings, lexical entries, graph edges, summaries, caches, queues, logs, exports, provider copies, replicas, and backup deadlines. It must also preserve unaffected scopes and any permitted content-free tombstone. A completed row deletion is therefore evidence of one step, not proof of erasure closure.

Distinguish suppression, expiry, content deletion, metadata tombstones, and media sanitization. For T-OAK/U-19, scan exact and paraphrased traces of the carrier note after deletion, restore a backup after its declared deadline, and confirm that COPPER-KITE-31 remains available only in its unaffected scope.

Where the General Data Protection Regulation applies, Article 5 subjects personal data processing to purpose limitation and storage limitation. Article 17 provides a qualified right to erasure within its applicable scope and exceptions. Territorial, material, processing, and organizational facts affect those duties. This page gives no legal advice. External research S15

Audit records should name the actor, request, scope, surfaces checked, residue, and terminal state. NIST Special Publication 800-53 Revision 5 supplies organization-defined access, audit, accountability, and retention control guidance. It does not define erasure closure for agent memory. External research S10

External processing boundary

Where do model and provider boundaries end?

Model and provider boundaries end where the receiving party's documented processing, retention, deletion, logging, training-use, region, and incident terms begin. The application must inventory what leaves, why it leaves, who receives it, and how fallback behaves. Model instructions can limit intended use inside a prompt, but they cannot enforce a provider's deletion or contractual obligations.

Put purpose and personal-data gates before an external call. Record the payload class, provider, purpose, region where relevant, retention terms, training-use terms, deletion process, logs, incident path, and fallback. Provider documentation is evidence about that provider's stated behavior at a point in time. Microsoft's agentic-memory safety page is living vendor documentation that illustrates one current approach, not a neutral standard. External research S16

Synthetic boundary trace

Write, read, act, delete threat and control map

Adversarial verification

How should memory security controls be tested?

Memory security controls should be tested as adversarial invariants across ingestion, retrieval, context assembly, host execution, recovery, and erasure. Inject adaptive and encoded content through each supported channel, then probe foreign scope, stale state, retries, false receipts, restored backups, and delayed triggers. Passing tested cases reports observed behavior only, so results must name the scope, configuration, counts, and unresolved channels.

• Use adaptive, encoded, multilingual, fragmented, and multi-turn injection in text, documents, metadata, tool results, summaries, and imported memory.
• Test direct store access and query-only injection. Restart sessions and workers before probing delayed triggers.
• Run exact canaries, paraphrases, inference probes, repeated draws, foreign identifiers, revoked credentials, stale evidence, and host-bypass attempts.
• Inject commit faults, replay keys, alter payloads, submit false receipts, restore backups, scan residue, and retain an unaffected-scope control.

Deterministic controls should require zero unauthorized reads, writes, privilege changes, and effects in tested cases. Report “zero observed in the tested cases,” not “zero risk.” InjecAgent and AgentDojo provide bounded environments for indirect injection and tool-using agents. NIST AI 100-2e2025 is a final NIST report for adversarial machine-learning terminology, not control certification. External research S06 S07 S08

Record the earliest failing boundary and carry the case into the agent memory evaluation plan so security failures remain release blockers rather than changes to an aggregate score.

Dated product boundary

Current ContextDB mapping

Current ContextDB behavior

At repository snapshot d59c1b9, current credential, tenant, PII handling, audit, on-request forgetting, and action evaluation controls are Alpha or Cloud Alpha as stated in the status ledger. Scheduled retention is Planned. A project credential authenticates a project. user_id is a partition key, not an identity assertion. Action decisions are advisory, receipts are host-reported, and audit coverage is split across named chains and exports.

Review the dated details and gaps on ContextDB security. The contextual trust model explains the advisory action boundary without transferring host authority. This mapping does not imply certification, complete audit coverage, downstream verification, a service-level agreement, or the full neutral control set above.

Boundary questions

Questions about agent memory security