Why long-term memory is an attack surface
Agent memory reuses preferences and task information, but it can also preserve attacker instructions. A stored sentence may appear harmless until later retrieval quietly changes a real tool action.
The July 29 MemSecBench preprint follows poisoning across a complete Write–Execute–Forget lifecycle rather than checking storage alone.
Benchmark and results
MemSecBench contains 310 cases from 48 realistic contexts spanning code and science, daily life, and office work. It evaluates 24 isolated configurations combining two agent harnesses, four memory backends, and three LLM backends.
The authors report that malicious memory persisted in 84.2% of all cases and the complete Write–Execute attack succeeded in 50.3%. Among successfully poisoned cases, 59.6% completed the full execution chain. Attack and selective-repair outcomes differed substantially across configurations.
Operational lessons
Memory should be treated as a trust boundary connected to execution privileges, not merely a database. Record origin, user, and permission at write time, and isolate untrusted text as quoted data rather than executable instruction.
At retrieval, evaluate the current request together with memory provenance. Reconfirm the original instruction and require approval before writes, payments, or external messages. Deletion should trace paraphrases, derived summaries, and embeddings, not only one string.
Limitations
This is a preprint, and results depend on the selected harnesses, backends, and adjudication design. It does not recreate every production permission system or user behavior. Its lifecycle-based evaluation is nonetheless a useful pattern for security testing.