News · 2026-08-02

Four agent-memory papers landed in a week, and none tested what happens when an attacker controls the writes

Four papers published within days of each other define an AI agent's memory as four mutually incompatible things: a detachable pretrained module, a rewritten lesson, a folder of markdown files, and a decaying reliability score for peer agents. Three of the four introduce state that is written during operation and shapes all later behaviour, and none evaluates what an adversary who controls those writes could do. One of them also reports that storing memory in weights makes the model reproduce its held-out training data more readily.

Key facts

• Four definitions in one week: Memory Decoder at Scale, MemHarness, Filesystem-Based Memory, and Sigma-Mem.
• The extraction signal: Memory Decoder reports its module reproduces held-out training continuations more readily than matched continued pretraining — a real leakage indicator, though not a full privacy attack evaluation.
• The untested surface: Sigma-Mem's "counterfactual attack" is a controlled swap of answers and labels, not a live feedback-poisoning or identity-spoofing test.
• Primary sources: the four papers plus an accompanying survey that defines explicit memory through controllable read and write semantics.

Start with why this is a security story rather than only an architecture story. An agent with memory is a system whose future behaviour depends on state it wrote earlier. That is exactly the property that makes memory useful and exactly the property that makes it an attack surface. If an attacker can influence what goes into memory, they influence every decision that reads it afterwards — a persistent version of prompt injection that survives the session, and structurally the same problem as data poisoning moved one layer up the stack.

The four papers each build that state differently, which is precisely the problem: there is no shared threat model because there is no shared object.

Memory Decoder puts memory in weights. It builds nearest-neighbour supervision offline over a large deduplicated corpus, compresses and shards the index, then trains a detachable module at multi-billion-parameter scale whose output distribution is blended with a frozen base model. At deployment there is no database lookup, because the retrieval signal has been baked in. Its gains concentrate on knowledge-heavy question answering rather than persistent agent work. And it reports something that should give people pause: the memory module reproduces held-out training continuations more readily than matched continued pretraining does. That is a genuine extraction-risk signal — memory that lives in weights is memory that can be pulled back out — though the authors do not run a full privacy attack evaluation. The accompanying survey defines explicit memory through controllable read and write semantics and explicitly excludes static pretrained weights, which would disqualify Memory Decoder from being agent memory at all. The field cannot agree on the noun.

MemHarness is the direct rebuttal to retrieve-and-paste. It stores distilled natural-language principles alongside the historical observation that produced each one, and a trained policy retrieves an entry, compares the old situation to the present one, and emits adapted guidance or an explicit nothing before acting. Its ablations show raw replay actively hurting the agent, and removing the source observation hurting performance. That is real mechanism evidence — obtained in two simulated environments with model-generated cold-start traces, not on a real repository or desktop under adversarial writes.

Filesystem-Based Memory is the practical one, and its result is bracingly sober: better organisation substantially reduces the cost of searching a large memory store, but no layout consistently produces better answers. Simple verbatim stores can win. Switching the tool harness changes the resulting file tree as much as switching the model. Adherence to a taxonomy erodes as the store grows, except under the strongest manager. A memory file is not self-organising. We covered this finding directly: organising an agent's memory halves search cost but does not improve answers.

Sigma-Mem is the odd one out and the most security-relevant. It remembers which peer agents are reliable in which task directions and which tend to fail together, using decayed symmetric matrices to route work or weight votes. Its mathematical guarantee bounds how much any single update can move the ledger, under assumptions that competence is stationary and noise is well behaved. It says nothing about whether the feedback source is honest. The paper's own ambiguous-history condition makes the memory actively misleading, and what it calls a counterfactual attack is a controlled swap of answers and labels — not an adversary feeding deliberate false correctness signals or impersonating a trusted peer.

Put the four side by side and the gap is obvious. Memory Decoder leaks training continuations. Sigma-Mem updates trust on unvalidated feedback. Filesystem memory is a directory that any agent with tool access can edit. Each paper evaluates its system against difficulty; none evaluates it against malice. That gap is not hypothetical: the same week, Palo Alto's Unit 42 published logs showing an attacker's agent with terminal access running unattended, which is exactly the deployment shape where a poisoned memory write compounds.

One clarification, since "context degradation" gets invoked to explain all of this at once. The literature supports something narrower. Lost in the Middle (2307.03172, peer-reviewed) finds that models use material at the beginning and end of a long input more reliably than material in the middle — not that long prompts fail. RULER (2404.06654) shows that passing a single needle-in-a-haystack test is insufficient, because models that retrieve one fact collapse on multiple facts or aggregation as length grows. Neither is a current claim about 2026 context windows. Three different things get conflated: a model failing to use a note after it is injected, a store losing or stale-dating the note before injection, and a trust system updating on bad feedback. They need different fixes.

The caveat is that all four are recent preprints with author-reported results and no independent replication, evaluated in simulated environments. What is solid is the observation that the field has produced four incompatible definitions and one shared blind spot — and a memory-poisoning benchmark is the obvious thing someone should build next.

Primary source, verified: read the paper → (arXiv 2607.27919)

Ground Truth. (2026, August 2). Four agent-memory papers landed in a week, and none tested what happens when an attacker controls the writes. Ground Truth. https://groundtruth.day/news/four-agent-memory-papers-and-nobody-tested-a-poisoned-write.html

@misc{groundtruth:four-agent-memory-papers-and-nobody-tested-a-poisoned-write,
  title  = {Four agent-memory papers landed in a week, and none tested what happens when an attacker controls the writes},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {aug},
  url    = {https://groundtruth.day/news/four-agent-memory-papers-and-nobody-tested-a-poisoned-write.html}
}

Topics: cybersecurity · ai-security · agent-memory · ai-agents · data-poisoning · research