Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Source

arXiv

arxiv.org/abs/2607.27080v1

Read the source

Source

Plain-Language Brief

MemSecBench is a new benchmark for testing the lifecycle security of agent memory systems. The benchmark contains 310 cases drawn from various contexts, and it follows a controlled protocol to test the persistence, consequences, and repair of malicious memory in different configurations of agent harnesses, memory backends, and LLM backends. The results show that in most cases (84.2%), malicious memory persists, and the full Write--Execute chain succeeds in about half of the cases. Among the successfully poisoned cases, more than half complete the execution chain, and about half achieve selective repair.

What the Document Says

  • MemSecBench is a benchmark for testing the lifecycle security of agent memory systems.
  • It contains 310 cases drawn from various contexts.
  • Each case follows a controlled Write--Execute--Forget protocol.
  • The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends.
  • Malicious memory persists in 84.2% of all cases.
  • The full Write--Execute chain succeeds in 50.3% of the cases.
  • Among successfully poisoned cases, 59.6% complete the execution chain.
  • About half (56.1%) achieve selective repair.

Key Concepts Mentioned

  • MemSecBench
  • agent memory systems
  • lifecycle security
  • malicious semantics
  • Write--Execute--Forget protocol
  • adjudication
  • configuration
  • memory backend
  • LLM backend
  • persistent malicious memory
  • end-to-end attack success
  • selective repair

Claims Made by the Document

  • MemSecBench addresses a gap in examining the lifecycle security of agent memory systems.
  • The evaluated memory system stacks differ in lifecycle security.

Evidence Used

  • The introduction and experimental design details provided in the text

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons. To address this gap, we introduce MemSecBench, a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write--Execute--Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints. The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Across all 24 configurations, malicious memory persists in 84.2% of all cases, and the full Write--Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.Compared with matched Native configurations, the largest absolute differences are 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair. These descriptive contrasts indicate that the evaluated memory system stacks differ in lifecycle security, both in the propagation of malicious memory and in selective repair after successful memory poisoning.