Memory Poisoning is a shipped attack. Guard the writes.
Persistent agent memory is now a formal attack surface. OWASP ASI06 and MITRE ATLAS AML.M0031 name it directly. A poisoned document stored today shapes agent behavior across future users and tenants until someone notices. Guard sits between the agent and the memory tool, so poisoned content never becomes policy.
In-process libraries harden the store. Guard governs the writes. Same architecture as Okta plus Guard for identity.
Why memory is the underrated attack surface.
The payload is already inside.
Prompt-level defenses catch the instruction at the door. Memory poisoning happens after the content is stored. Traditional input filtering does not see it.
One poisoned document becomes policy.
A scraped doc, a user-supplied file, a tool output. Stored once, it steers agent behavior across sessions, users, and tenants for weeks.
Detection tools tell you after the fact.
Post-hoc analysis flags weird outputs. It does not tell you which memory row caused them, or how to roll back. You need policy at the write, not analytics after the harm.
Two layers, one attack surface.
Memory hardening is defense-in-depth. The library protects the store. Guard governs the writes. Neither alone covers OWASP ASI06 end to end.
The memory store itself.
In-process memory library
Runs inside the agent process. Classifies content already in the store. Detects tampering. Provides rollback. Enforces cross-context isolation at the read path.
The write path, before content reaches the store.
Conduct Guard
Sits at the wire, in front of every memory-write and memory-read tool call. Blocks or warns on writes that would introduce poison, promote untrusted content to durable tiers, or leak across tenant namespaces. Every decision lands in the hash-chained audit.
In the OWASP pack today
Five ASI06 rules ship in conduct-owasp v2.2.0.
Every rule is tagged with OWASP ASI-06 and MITRE ATLAS (AML.M0031) for compliance evidence.
asi06_memory_write_without_classification
Fires when an agent writes to persistent memory without a source or trust classification tag. Untagged content silently becomes policy across future sessions.
asi06_untrusted_promotion_to_durable
Fires when untrusted content (user input, scraped, tool output) is promoted to durable or long-term memory tiers without an explicit trust-promotion step.
asi06_instruction_shaped_memory_write
Fires when a memory write contains text that would act as a delayed instruction override on future recall.
asi06_cross_tenant_memory_read
Fires on memory reads that span tenant or namespace boundaries. Cross-context reads leak one context poison into another.
asi06_memory_integrity_bypass
Fires when writes to a trusted or verified tier omit an integrity claim (hash, signature, attestation).
Reference architecture: Guard plus in-process memory hardening.
Wire the two layers together for end-to-end coverage of OWASP ASI06 and MITRE ATLAS AML.M0031.
- 1. Agent invokes a memory-write tool. memory_save, vector_store_add, mcp__*memory*, or any tool matching the memory naming pattern.
- 2. Guard proxy or hook evaluates the call. OWASP ASI06 rules check for classification tags, untrusted-promotion attempts, instruction-shaped content, cross-tenant scope, and integrity claims. Allow, warn, or block returns before the tool executes.
- 3. Allowed writes reach the in-process library. An in-process memory-hardening library applies in-store classification, cross-context isolation, and integrity tracking.
- 4. Both layers write to the same audit chain. Guard decisions plus in-process events feed one hash-chained record. Auditors query one table, not two.
- 5. Rollback is a first-class action. When the library detects tampering, it triggers a rollback and Guard records the event with lineage back to the write that caused it.
Compatible with any memory-hardening library that implements the ASI06 primitives (classification, promotion controls, isolation, integrity). The OWASP Agent Memory Guard project is the reference implementation named by MITRE ATLAS AML.M0031.
Cover OWASP ASI06 at the wire today.
Install the OWASP pack, get five ASI06 rules mapped to MITRE ATLAS AML.M0031. Pair with your memory-hardening library for end-to-end coverage.