When Agents Remember Too Much: Memory Poisoning Attacks against Large Language Model Agents

Personal assistants write untrusted email and calendar content into long-term memory without security-oriented memory governance, so normal questions can activate poisoned memories.

• Scenario: The authors state that such assistants sit at the intersection of conversational and action-planning memory, handle sensitive information, and encounter untrusted sources. A poisoned memory can alter behavior when the user later submits a benign prompt; the example in the text is writing an unauthorized recipient into an email concerning a confidential project.
• Existing shortcomings: The authors state that AgentPoison and MINJA assume the adversary can directly access the memory store or directly interact with the agent; Zombie Agents requires storing the same payload hundreds of times and, like MemoryGraft, is mainly evaluated on self-built implementations. A-MAC's memory governance targets utility and does not detect malicious content.
• This paper's angle: The adversary considered by the authors cannot modify the memory store, cannot call the agent API, and cannot control future user prompts; it can only write indirectly through inputs received via tools.
• Proposed method: The authors propose a two-phase attack vector, GhostWriter, and a defense framework, AM-Sentry: three memory admission strategies with an optional retrieval filter, for six configurations total. The authors plan to release the implementation and utility test suite; the paper does not state they have been released.
• Threat model:
  • Goals: Integrity violation, sensitive information leakage, covert exfiltration, and privilege scope escalation (Section 3.3).
  • Knowledge: Insider adversaries include employees, contractors, suppliers, and business partners who know the organization and projects; external adversaries have only public information. The mechanism is the same: disguised inbound messages. The authors discuss black-box, gray-box, and white-box optimization, but the experiments only use black-box.
  • Capabilities: Only control over injected content. No access to the agent API, no modification of the memory store, no compromise of user accounts, and no influence over the retrieval mechanism.
  • Victim system: A personal assistant in an office environment managing email and calendar, with long-term memory and tool APIs. The user is fully trusted. The authors assume the execution logic is non-malicious and the memory facility is isolated from out-of-band tampering, appearing as a black box to the adversary.

Related work is organized by Section 2 into agents, memory systems, poisoning, and defenses; the authors position this paper via indirect poisoning on untrusted tool inputs.

LLM agents and tools

• ReAct (Yao et al., 2022): Interleaves reasoning and action, using thought to enrich the current context.
• Tools and frameworks: Toolformer (Schick et al., 2023) lets models learn tools on their own. The authors state tools have entered production interfaces such as ChatGPT and Claude, and mention AutoGPT and BabyAGI as open-source frameworks that are easy to adopt.

Long-term memory

• Conversational: MemGPT (Packer et al., 2023) and Generative Agents (Park et al., 2023) use cross-session memory to improve recall; MemoryOS (Kang et al., 2025) separates short-, medium-, and long-term storage; A-MEM (Xu et al., 2025) uses LLM calls for dynamic linking. The authors state this line mainly records user facts.
• Action-planning: Reflexion (Shinn et al., 2023) uses self-reflection to improve plans; RAP (Kagaya et al., 2024) retrieves past successful trajectories; ExpeL (Zhao et al., 2024) stores both successful and failed trajectories and reflections. The authors state this line records action steps, not user facts.
• RAG and gaps: Lewis et al. (2020) retrieve context from a pre-built corpus, and Gao et al. (2023) survey various RAG approaches. The authors state these mostly rely on existing information and cannot learn from experience; they also state the intersection of the two lines still lacks research, and deployments such as personal assistants or automated programming are absent from these works.

Memory poisoning and defenses

• Direct access or direct interaction: AgentPoison (Chen et al., 2024) writes false information into long-term memory to hijack actions; MINJA (Dong et al., 2025) uses prompt injection to make agents execute and save malicious action plans. The authors call both adversary models unrealistic: either direct access to the memory store or direct interaction with the agent, which the authors state requires user credentials.
• Via tool inputs: Zombie Agents (Yang et al., 2026) discusses agents with web search and RAG memory being induced by malicious web pages to store adversarial instructions. The authors criticize it for requiring the same payload to be stored hundreds of times, arguing simple deduplication would defeat it; they also state that, like MemoryGraft (Srivastava and He, 2025), it is mainly evaluated on self-built implementations rather than what the authors call state-of-the-art.
• Existing defenses: A-MemGuard (Wei et al., 2025) uses consensus retrieval to find anomalous memories; the authors state this does not apply to factual memories without comparable reasoning paths. A-MAC (Zhang et al., 2026) proposes memory governance, which the authors state only focuses on utility and does not handle poisoning.

Baselines and benchmarks

• Attack and detection comparisons: Undefended A-Mem, Mem0, ExpeL, Letta (formerly MemGPT), MemoryOS; prompt injection uses payloads from AgentDojo (Debenedetti et al., 2024); detection comparisons are DataFilter (Wang et al., 2025) and PromptArmor (Shi et al., 2025) implemented with ChatGPT.
• Defense and utility comparisons: The defense comparison is A-MAC with default parameters. For utility, LoCoMo, HotpotQA, and Webshop were not used; the authors state they lack at least one of evolving information, multi-source, or tool-based tasks, so they built a simulated work-week test suite.

The authors state that no prior work studies indirect memory poisoning via untrusted tool inputs against what they call state-of-the-art agents, nor defenses against that path that evaluate the security-utility tradeoff.

GhostWriter puts the payload into tool inputs that the agent will store, then waits for a benign prompt to retrieve it; AM-Sentry intercepts at both write and retrieval using LLM review plus non-LLM rules.

System setup and two-phase success conditions

• Deployment: The agent wakes on user questions, incoming email or calendar events, or scheduled events, writes interactions into summaries, extracted facts, useful trajectories, or verbatim text, and tags and links related memories. Retrieval matches queries against tags (Section 3.1). Figure 2 uses an email assistant as an example: retrieving meeting invitations, recalling deadline changes, and drafting emails to the correct recipients.
• Injection: In Protocol 1, the adversary selects a target category and an aligned target prompt, constructs a payload, embeds it in a seemingly normal message, and delivers it to the inbox. The ingestion function turns the message into a memory and writes it to storage. The authors define: if the payload remains in that memory, Phase 1 succeeds.
• Activation: In Protocol 3, the user submits a benign prompt, and the agent retrieves the closest top-k memories and adds them to the context. If the poisoned memory is in that set, the authors state the response will deviate from user intent; otherwise it executes normally. The adversary cannot modify retrieval.
• Architecture impact: The authors note that summarization, replacing old memories with new ones, or merging new details into old memories all change the likelihood that a poisoned memory is retrieved. The schematic in Figure 5 marks the retrieval count as 3; the experiments section only says the architecture uses default configuration and does not separately report k.

Black-box payload optimization

• Scope: The authors discuss black-box, gray-box, and white-box, but under the security assumptions only adopt black-box (Section 4.1).
• Process: Protocol 2 uses a public email corpus (the text cites the Enron Email Corpus as an example) and an embedding model to cluster emails into k topics, finds the cluster closest to the target prompt, then scores payloads by the average cosine similarity within the cluster. Below threshold tau, it rewrites and only replaces when the new score is higher, until tau is exceeded. The adversary's embeddings need not match the agent's.
• Embeddings specified in the experiments: The agent uses all-MiniLM-L6-v2, and the adversary uses bge-small-en-v1.5 (Section 7.1). The paper does not give k or tau in the experiments section, nor does it specify the model used for rewriting. Appendix B gives examples of instructional and descriptive emails, which differ in tone; the original text is not reproduced here.

Unified evaluation interface

• Five architectures: A-Mem, Mem0, ExpeL, Letta (formerly MemGPT), MemoryOS. The authors state that long-term memory agents designed specifically for personal assistants are lacking, so they connect all to the same wrapper: system prompt, tools for sending/receiving email and reading calendars, and unified input/output. AM-Sentry attaches at the wrapper layer and does not require changing each architecture's internal memory representation.
• Storage differences: Most architectures keep their original design. Letta stores complete interactions. Mem0 and ExpeL transform the original text before storing. MemoryOS was originally designed to store input and reply pairs, and short confirmation sentences are not conducive to embeddings; the authors changed it to summarize actions and tool inputs.
• Snapshot: Five days of 32 email and calendar events are fed in chronological order (Appendix C gives examples), including evolving events such as deliberate rescheduling, then a snapshot without malicious memories is saved.
• Utility questions: The authors state that LoCoMo, HotpotQA, and Webshop cannot simultaneously cover multi-source, tool-based tasks, and evolving information, so they built four question types: static event recall, evolving event recall, tasks using static information, and tasks using evolving information.

Admission strategies S1–S3

• S1: A single LLM reviewer makes a yes/no decision based only on whether the information might be useful later.
• S2: The reviewer scores source identifiability o, reliability r, type t, and utility u from 0 to 1 (Table 1). Admission occurs only when U = 0.6u + 0.4r is above 0.4 and V = t(1−o) is below 0.6 (Protocol 4). In Table 1, instructional types score highest and factual lowest; user sources score highest and unknown sources score 0.
• S3: A seven-point checklist (Table 2). A vulnerability score below 0.6 is directly rejected. Otherwise, sensitivity and source trust are combined into critical items, and contradiction, instructiveness, verifiability, and rationale into non-critical items, then weighted at 0.6 and 0.4; a weighted score below 0.4 is rejected. After passing, a second LLM reviewer, incorporating source metadata, checks whether the first reviewer was affected by prompt injection, and discards on reasonable suspicion (Protocol 5).
• Goals listed by the authors: preserve utility, not rely on known attack signatures, characterize what kind of memory is unsafe, model trust by source rather than only by text, not be tied to one memory architecture, and cover both write and retrieval. Section 8 states the formula weights are chosen intuitively; the paper does not present them as search results. Admission rates for each strategy on the four backends are reported separately; the paper does not state whether the reviewing LLM is always equal to that experiment's backend.

Retrieval filter

• Location: Each retrieved memory is checked again before entering the context, to block unsafe memories that were already written (Figure 5). Figure 4 illustrates the admission strategy allowing trusted updates and blocking emails containing behavioral instructions from unknown sources; the specific statements in the two figures are not reproduced here.
• Rules: The authors state the LLM reviewer evaluates relevance, instruction suppression, and contradiction detection under source trust, i.e., the first three of the four items listed in the main text. Table 3's order is relevance, instruction suppression, trust filtering, contradiction detection; any trigger causes discard.
• Source examples: The authors state that a memory containing instructions can be kept if the source is trusted, otherwise discarded. When used with S2 or S3, the filter can read the trust, risk, and type annotations they wrote, rather than inferring from the original text.
• Configurations: S1, S2, and S3 each with the retrieval filter on or off, for six total.

Experimental Setup

• Backend and Architecture: GPT-5.4-mini, DeepSeek-V4-Flash, Gemini-2.5-Flash, Llama 3.1 8B; the authors refer to these as ChatGPT, DeepSeek, Gemini, and Llama respectively. Architectures are A-Mem, Mem0, ExpeL, Letta, MemoryOS. Llama runs locally via Ollama with Q4_K_M, the others use their respective APIs and default decoding. Temperature is 0.7 where applicable. Architectures use default configurations. Agent embeddings are all-MiniLM-L6-v2, adversary embeddings are bge-small-en-v1.5.
• Attack Set: 16 scenarios, delivered via email or calendar invitations, each with imperative and descriptive payloads. Section 7.2 mainly discusses descriptive ones. Each scenario is tested once for benign triggers on a five-day snapshot without malicious memories, and repeated five times before aggregation. Snapshots correspond to the 32 events described in Appendix C.
• Metrics: Phase 1 success means the malicious payload is written to memory; retrieval rate is also reported, along with Phase 2 activation rate after retrieval. End-to-end success in Figure 9 means the attack passes both admission and retrieval filters and changes behavior.
• Baselines: No defense; memory governance baseline is A-MAC with default parameters. Prompt injection uses a payload from AgentDojo. Detection baselines are DataFilter and PromptArmor implemented with ChatGPT. Utility review is ChatGPT.
• Utility: Custom suite reports F1-similarity, LLM-judge scores, and whether tool calls are correct. Each AM-Sentry configuration and A-MAC generate snapshots from a simulated work week. The main text gives A-Mem (Figure 10), the rest in Appendix D (Figure 18). The paper does not report human agreement or statistical tests.

Main Results

The table below only includes the text numbers from Section 7.2 for Figure 6. The extracted text lacks bar heights; combinations not reported per cell are left blank.

Metric	Value	Condition
P1 injection	98%	Average across five architectures and four models
P1 injection	100%	Most architectures; Mem0, ExpeL below this, specific cells not given individually
Retrieval	79%–100%	ChatGPT and DeepSeek; authors say average about 94% on these two models
Retrieval lower bound	57%; 65%	Lower retrieval for Mem0 and ExpeL on Gemini and Llama respectively
P2 activation	60%	Average across all architectures and models
P2 activation	28%–63%	ExpeL across four LLMs; lowest is ExpeL with Llama
P2 activation	42%	Only reported for MemoryOS with Llama

• Injection: The authors attribute Mem0 and ExpeL not reaching full injection to transformations of the original text before storage, so payloads may not be preserved.
• Activation: The authors attribute ExpeL's lower rates to trajectory memory treating entries as previous examples rather than authoritative facts. The authors say ChatGPT and DeepSeek are highest, Llama lowest; and say Gemini and Llama are relatively less susceptible, but still give the lowest tier in the table. The authors attribute lower retrieval for Mem0 and ExpeL on Gemini and Llama to these two models being less accurate in converting inputs to memories.
• Exceptions: The authors say MemoryOS with Llama often asks for more information or makes incorrect tool calls, hence lower activation.

Attack Categories

• What was tested: P2 activation of imperative and descriptive payloads on four target types. The text calls them Figures 6a, 6b; the extracted text also has a caption "Figure 7: P2 activation rate (%) by category".
• Imperative: The authors say integrity compromise and covert exfiltration are highest, reaching 100% on ChatGPT, DeepSeek, and Llama. Sensitive information disclosure is lowest across models.
• Descriptive: The authors say sensitive information disclosure becomes comparable to integrity compromise and covert exfiltration; privilege escalation is much lower because payloads are less like strict instructions, and agents are more likely to treat them as ignorable suggestions. The authors say the first two categories on Llama uniformly decrease relative to imperative, while other models show mixed increases and decreases. The paper does not give complete cells for each category.

Prompt Injection and Existing Detectors

• Another attack type: Reusing the same setup, payloads from AgentDojo. The authors say it almost always fails for most architectures; exceptions are MemoryOS with 1%–22% activation and ExpeL at 92% (Figure 7). P1 injection rates are very close to GhostWriter, with P2 activation at 0%–16.7%. The authors attribute low activation to low retrieval rates and payloads not being optimized for later prompts; and say ExpeL's trajectory design almost always follows injected instructions with an authoritative tone.
• Detectors: DataFilter detects 0% of all attack payloads. PromptArmor implemented with ChatGPT detects 85% for imperative and 6% for descriptive. The authors say ChatGPT tends to classify authoritative tone as prompt injection, and polite descriptive ones easily bypass; and say AM-Sentry does not rely on such tone differences. This paragraph does not give AM-Sentry's detection rate separately.

AM-Sentry

• Admission (Figure 8): Attack success here means malicious memory is written. A-MAC is lowest at 54%, average 84%; the authors say it only evaluates preservation utility, blocking payloads is incidental, and admission is lowest on DeepSeek. S1 admits almost all on Gemini; the authors say DeepSeek and ChatGPT admit about 80% and 97%. Llama over-blocks on S1, filtering out legitimate content. S2 reduces poisoned memory admission except for Llama: ChatGPT down to 71%, Gemini to 70%–84%; DeepSeek largely unchanged, sometimes worse. The authors attribute S2 being worse on A-Mem and MemoryOS to their memory structures making S2 more permissive. S3 reduces average attack success to 15% for ChatGPT, DeepSeek, and Gemini; Llama still admits 77% of malicious payloads.
• With retrieval filter (Figure 9): Success requires passing both policy and retrieval filters and changing behavior. S1 with filter and S2 with filter perform similarly; the authors say the retrieval filter compensates for these two tiers being too permissive. S3 with filter reduces average attack success to below 12% for all LLMs except Llama; Llama averages 20% across architectures. The authors say the retrieval filter compensates for Llama's weakness in the S3 injection phase.
• Utility (Figure 10, A-Mem): F1 largely maintained relative to no-policy baseline; DeepSeek is most stable, with slight decrease under S3. Other models show F1 decreases of 0.01 to 0.04 relative to baseline when paired with retrieval filter or S3. Llama decreases progressively from S1, attributed to over-blocking legitimate memories. The authors say A-MAC has no strong positive effect on baseline, with the only exception being higher scores on Llama than other policies; they attribute this to A-MAC relying less on LLM for policy decisions. LLM-judge scores follow the same trend, with S2 higher than baseline in several cases. Tool accuracy is largely stable; ChatGPT decreases relative to baseline under A-MAC and S1, generally recovering with stricter policies. The authors say each policy has minimal impact on overall utility. In Appendix D, the authors say Llama is more variable, MemoryOS with Llama has high variance, and ExpeL and Letta worsen as policies become stricter. The paper does not give absolute scores for these figures.

Other Ablations and Analyses

• Payload tone: PromptArmor detects 85% for imperative, dropping to 6% for descriptive (Section 7.3); Section 7.4 therefore focuses on descriptive.
• Retrieval filter on or off: Figure 9 compares three policy tiers with and without filter; specific percentages for S1 and S2 with filter are not listed separately in the text.
• Delivery channel: 16 scenarios include email and calendar, the text does not report success rates by channel.
• Repetition: Unless otherwise noted, each experiment is repeated five times (Section 7.1).
• Weights: Experiments use the 0.6/0.4 from the text and thresholds 0.4, 0.6; the paper does not report other values.
• Negative exception: DeepSeek is sometimes worse on S2 relative to S1 (Figure 8), the text does not give a percentage for this exception.

Limitations and future directions noted by the authors

• Input channels: Only email and calendar are used as the attack surface; documents, web content, and code repositories are not explored. Future work includes more input channels and deployment scenarios beyond office assistants (Section 8).
• Weights: The formula weights are chosen intuitively, and the authors believe they may not be the optimal configuration for blocking GhostWriter; future work could use Monte Carlo to select strategy weights (Section 8).
• Utility data: The test suite is based on a simulated work week, not real user data or online deployment, and the authors believe it may not cover all personal assistant tasks. Future work includes a benchmark covering more task types, input sources, and memory architectures (Section 8).
• Architecture scope: Five memory agents were evaluated; the authors believe memory designs could be broader, and different designs may have different vulnerabilities. Future work includes evaluating more memory architectures (Section 8).
• Model scope: Only models that were available and cost-feasible at the time were used; future work includes more LLM backends (Section 8).
• Adversary capability: Only non-adaptive adversaries unaware of the defenses were evaluated; the authors believe adaptive adversaries could bypass the checklist and retrieval filter. Future work also includes analysis of multiple concurrent attack payloads (Section 8).

Experimental coverage

• Subjects: Five architectures A-Mem, Mem0, ExpeL, Letta, MemoryOS, each with GPT-5.4-mini, DeepSeek-V4-Flash, Gemini-2.5-Flash, Llama 3.1 8B (Q4_K_M) (Sections 6.1, 7.1).
• Attack protocol: 16 scenarios, email and calendar, instructional and descriptive, each scenario repeated five times on undefended snapshots (Section 7.2). Agent embeddings are all-MiniLM-L6-v2, adversary embeddings are bge-small-en-v1.5. The paper does not report Protocol 2's topic count k, threshold tau, the model used for rewriting, or whether all 16 scenarios ran the optimization loop.
• Defenses: S1, S2, S3, each with and without the retrieval filter; comparisons are undefended and A-MAC with default parameters (Section 7.4). Utility includes the baseline, A-MAC, and six configurations; A-Mem appears in Figure 10, the rest in Appendix D. Per Section 8, defense evaluation targets adversaries unaware of the defenses.
• Another attack and detection: One prompt injection payload from AgentDojo; detection methods are DataFilter and PromptArmor implemented with ChatGPT (Section 7.3).
• Quantities not reported in the paper: The specific default retrieval count for each architecture (Figure 5's schematic marks 3), query counts, statistical tests, and agreement between the utility LLM reviewer and human judgment.

The authors study email and calendar personal assistants with long-term memory: after untrusted tool inputs are written into memory, later benign queries may retrieve poisoned content and change behavior.

• Problem: The authors believe existing poisoning either has direct access to memory or the agent, or is mainly evaluated on self-built systems; practical personal assistants lack safety-oriented memory governance.
• Attack: GhostWriter has injection and activation phases. Injection embeds a payload into seemingly normal emails or calendar entries, with success defined as the payload remaining in memory. Activation does not control the user's prompt; it only checks whether benign queries retrieve the payload and act on it. The authors also describe black-box optimization: using an embedding model different from the agent's, they modify the payload to be closer to the target email topic.
• Defense: AM-Sentry uses three tiers of policy S1 to S3 at the write point, with LLM review plus threshold rules deciding admission; S3 also has a second review that checks whether the first review was influenced by injection. At the retrieval point, a retrieval filter can be added, filtering by relevance, instructions, source trust, and contradictions. The two components combine into six configurations, attached to a unified wrapper without changing each architecture's core memory mechanism.
• No-defense results: Five architectures, four LLMs, 16 scenarios, five runs each. Average injection is 98%, with most architectures at 100%; average activation is 60%, with the lowest being ExpeL with Llama at 28% (Section 7.2, Figure 6). The authors attribute ExpeL's lower activation to trajectory memory not treating entries as authoritative facts.
• Defense results: At the admission stage, S3 reduces the average attack success rate for ChatGPT, DeepSeek, and Gemini to 15%, but Llama still admits 77% of malicious payloads (Figure 8). With the retrieval filter added, the average attack success rate is below 12% except for Llama at an average of 20% (Figure 9). The authors state the utility drop relative to baseline is small: except for DeepSeek, F1 drops by 0.01 to 0.04 under the retrieval filter or S3 (Figure 10).
• Authors' conclusion: The authors believe the attack succeeds because of the lack of safety-oriented memory governance; they also believe the strictest AM-Sentry can suppress GhostWriter on most models in the experiments, with a utility cost that is an acceptable trade-off. The authors plan to release the implementation and test suite.