Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Source

arXiv

arxiv.org/abs/2607.27080v1

Read the source

Source

Plain-Language Brief

Researchers have developed a benchmark called MemSecBench to evaluate the lifecycle security of agent memory systems. The benchmark contains 310 cases from various contexts, each following a specific protocol and using a defined configuration. The experimental results show that malicious memory persists in most cases, and the full attack succeeds in over half of them. Selective repair is successful in about half of the poisoned cases, with significant differences between native configurations and those tested.

What the Document Says

  • MemSecBench is a benchmark for evaluating the lifecycle security of agent memory systems.
  • It contains 310 cases from 48 realistic contexts.
  • Each case follows a Write--Execute--Forget protocol with a controlled runtime and exact agent configuration.
  • The experimental design includes two agent harnesses, four memory backends, and three LLM backends, resulting in a 24-configuration matrix.
  • Malicious memory persists in 84.2% of all cases.
  • The full Write--Execute chain succeeds in 50.3% of cases.
  • In successfully poisoned cases, 59.6% complete the Execute chain, and 56.1% achieve selective repair.
  • There are significant differences between native configurations and those tested, with the largest absolute difference being 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair.

Key Concepts Mentioned

  • MemSecBench
  • agent memory systems
  • persistent malicious content
  • Write--Execute--Forget protocol
  • deterministic write check
  • checkpoint-specific judge-model evaluations
  • programmatic gates
  • memory backends
  • LLM backends
  • end-to-end attack success
  • selective repair

Claims Made by the Document

  • MemSecBench is used to evaluate the lifecycle security of agent memory systems.
  • It contains cases from various contexts.
  • The experimental results show that malicious memory persists in most cases and the full attack succeeds in over half.
  • Selective repair is successful in about half of the poisoned cases.
  • There are significant differences between native configurations and those tested.

Evidence Used

  • The text mentions MemSecBench as a benchmark for evaluating agent memory systems.
  • It states that there are 310 cases from 48 realistic contexts.
  • The text describes the Write--Execute--Forget protocol and controlled runtime.
  • It mentions the 24-configuration matrix of various components.
  • The text provides statistics on the persistence and success rates of malicious attacks.
  • It states that selective repair is successful in about half of the poisoned cases.
  • The text compares native configurations with those tested and mentions significant differences.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons. To address this gap, we introduce MemSecBench, a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write--Execute--Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints. The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Across all 24 configurations, malicious memory persists in 84.2% of all cases, and the full Write--Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.Compared with matched Native configurations, the largest absolute differences are 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair. These descriptive contrasts indicate that the evaluated memory system stacks differ in lifecycle security, both in the propagation of malicious memory and in selective repair after successful memory poisoning.