Agent Memory Under Attack: Poisoning, Staleness, and the Defences That Hold

Long-lived agents trust what they remember. The 2026 literature quantifies exactly how attackers and entropy exploit that trust — and what a memory architecture must do to survive both.

An agent running GPT-4o that trusts its own raw spatial memory fails more than twice as often on downstream navigation as the same agent given no memory at all (When Memory Lies, arXiv:2608.04574). That memory was not malicious — merely stale. In the same month, MAFIA (arXiv:2608.03844) demonstrated query-only attacks that plant malicious records in actively audited memory pools with up to 90.7% success, while audit detection collapses from a peak of 83.3% to 7.4%.

Put the two together and the conclusion is uncomfortable: agent memory is simultaneously an attack surface and a liability when left untended. Most teams have neither threat model in place. This article covers both, and three defence architectures that survived evaluation.

Why Memory Breaks the Prompt-Injection Mental Model

We have covered prompt injection against LLMs before, but memory poisoning is a structurally different problem:

• Persistence. A prompt injection poisons one request. A poisoned memory record re-enters context on every relevant query, for weeks, across sessions and users.
• Retrieval is the delivery mechanism. The attacker does not need write access to your memory store. They need their content embedded once — a web page, an email, a tool output — and the ability to shape queries so retrieval ranks it highly.
• Audits are per-record and semantic. Poisoning hides in volume and similarity. Semantic similarity checks are exactly what modern payload designs defeat.

If your defence assumes the memory store is only written by trusted code paths, you are defending the 2019 threat model of a 2026 architecture.

MAFIA: Query-Only Attacks That Beat the Audit

MAFIA's threat model is deliberately pessimistic: the attacker has no write access and the agent's memory is protected by semantic auditing of stored records. The framework defeats both constraints with two components.

1. Placement via probing. The attacker queries the memory pool to map its embedding landscape, allocates a budget across candidate injection points, and schedules insertions so each payload stays retrieval-competitive even inside large benign memory pools. Nothing is injected until probing says it will actually be retrieved.

2. Payloads as factual cloaks. The malicious payload is wrapped in compact, factually-styled statements that preserve the harmful effect while scoring high semantic similarity to legitimate content. Against audit mechanisms, detection drops from 83.3% at best to 7.4% at worst.

MAFIA result	Value
Attack success rate (query-only)	up to 90.7%
Peak audit detection without cloaks	83.3%
Audit detection with factual cloaks	≤ 7.4%
Write access required	none

The uncomfortable lesson: similarity is the wrong invariant. If your audit asks "does this record look like the others?", you have built a defence that fails precisely when it matters — at scale, against a patient adversary who can afford to probe.

Staleness: Poisoning Without an Attacker

When Memory Lies built a dynamic FrozenLake testbed where the environment changes under a memory-augmented VLM agent, then measured staleness detection (1,800 runs, six VLMs, text and image inputs) and downstream navigation (12,000 text-mode episodes over four LLM navigators).

Three findings matter for anyone running long-lived agents:

1. Text solvability does not imply visual grounding. The same models that reliably flag stale entries from text show vision F1 from 0.887 down to 0.067 on identical grids presented as images. The weakest keeps making fluent, confident decisions that simply ignore the picture.
2. Trusting raw memory is a safety liability. In the primary GPT-4o setting, an agent that consumes unaudited memory dies more than 2× as often as one given no memory. Stale memory is worse than no memory.
3. Auditing helps but does not close the gap. Transferring audit conclusions between modalities or tasks recovers some failures, not most.

The conceptual unification with MAFIA is the important part: staleness and poisoning are the same failure class — memory whose trust outruns its validity. This is the argument behind ScrubJay-MEM (arXiv:2608.04746), which borrows per-type perishability from scrub jay episodic cognition: a customer's legal name and yesterday's API response must not share a retention policy. Their ablation is telling — removing type-conditioned decay collapses temporal generalisation by a factor of 5.7.

Three Defences That Hold Up

1. Make unauthorised mutation cryptographically impossible

MutMem (arXiv:2608.02843), part of the HOM-AIMOS persistent memory engine, treats memory adaptation as an authorisation problem. Every non-trivial change to retrieval weights is a signed transition that binds a terminal provenance node, a signer epoch, quantised old and new weights, a no-fork predecessor, and two domain-separated SHA-256 commitments — verified with Ed25519 both in the database writer and in a portable verifier. Poison-likely content is not deleted; it is retained under signed, revisable labels that recall uses as trust evidence.

The record format is the idea in miniature:

{
  "record_id": "mem_9f31c2",
  "content": "Staging deploys require two approvers",
  "op": "ADD",
  "provenance_node": "runbook@2f1c (terminal)",
  "signer_epoch": 7,
  "weights": { "from": 0.62, "to": 0.71 },
  "predecessor": "no-fork:mem_9f30aa",
  "commitments": ["sha256:content", "sha256:weights"],
  "signature": "ed25519:..."
}

A record that cannot be silently rewritten is a record an attacker must forge — and forgery is detectable by a verifier that does not even need access to the live database. MutMem reports 91.8% on LongMemEval and 74.12% judged accuracy on LoCoMo with the full authorisation protocol enabled.

2. Keep provenance and make claims first-class

TrajWiki (arXiv:2608.00967) represents each memory as a source-grounded evolution trajectory: immutable episodic snapshots plus explicit claim-level operations — ADD, REVISE, DEPRECATE — compiled incrementally into a persistent Memory Wiki layer of interlinked entity and event pages. Queries route hierarchically from wiki page to trajectory to episodes.

The security-relevant property is that conflict and obsolescence become visible structure instead of lost overwrites. When a claim contradicts an observation — the exact failure mode of When Memory Lies — the trajectory shows where the claim came from, what has revised it, and whether anything ever deprecated it. Overwrite-based stores answer none of those questions.

3. Decay by perishability, not by age

ScrubJay-MEM encodes every memory as a jointly-bound What–Where–When tuple with an estimated perishability coefficient and utility horizon, retrieved by query-adaptive scoring, and revisable retroactively at O(1) LLM calls per update. The policy shape transfers directly to existing stores:

retrieval_policy:
  decay:
    by_type:
      identity_fact:   { half_life: 365d }
      project_state:   { half_life: 14d }
      environment_map: { half_life: 1d }   # the FrozenLake lesson
      tool_output:     { half_life: 6h }
  quarantine:
    on: [audit_disagreement, provenance_missing]
    action: exclude_from_retrieval

On their Temporal Generalization Test, ScrubJay-MEM is the only retrieval-based system with a substantially positive generalisation gap (+0.108), and it improves F1 by +2.66 over Mem0 on MemoryAgentBench EventQA-64k. Decay is doing real work here, not decoration.

A Hardening Checklist for the Stack You Already Run

1. Append-only by default. Mutation is a signed transition, never an in-place UPDATE.
2. Sign memory writes (Ed25519); verify in the writer and an independent verifier.
3. Require provenance per record. Records without it go to quarantine, not to retrieval.
4. TTLs by content type, not one global default — an environment map expires daily; a customer's legal name does not.
5. Deprecate rather than delete, and keep poison-likely labels visible to recall as trust evidence.
6. Audit on write and on retrieval — and never on similarity alone. MAFIA's cloaks exist to defeat exactly that.
7. Red-team with query-only attacks: probe → inject → measure how often poisoned records actually get recalled. Recall rate is the metric that matters, not presence in the store.

The Takeaway

Memory is what gives agents their edge over stateless prompting — and it is the largest unattended attack surface in most current deployments. The 2026 literature converges on a single design principle: trust must be granted per record, maintained per record, and revoked per record. Cryptographic mutation control, claim-level provenance, and perishability-based decay are three complementary mechanisms for doing exactly that. Anything less, and the longest-running process in your agent system — its memory — quietly executes the attacker's plan for free.

Further background on memory architectures and their trade-offs: HMARS and the hierarchy problem, MemPalace and local-first memory, and PGMem's persona-memory graphs.