Agent Memory Integrity
Does your agent's memory notice when someone changes it?
12 of the 12 stores that make no integrity claim served every applicable edit as genuine. 20 agent memory and checkpoint stores, 37 rows, seeded through their own APIs, edited behind their backs nine ways, and asked to read their memory again. The 12 that claim tamper evidence were measured against that claim, with the detection point named.
See the scorecard Run it in CI Meet the memory agent
Measured 2026-10-08 · Darwin arm64, Python 3.12 · agmi 0.6.3
The problem in three frames
An agent remembers
Facts, decisions and checkpoints go into a store: a SQLite file, a Postgres table, a vector index, a cloud service.
Someone edits the store
No keys, no API: a mounted volume, a shared database credential, a restored backup, a data-plane role. One record changes.
The agent believes it
It reads the store the way it always does and acts on the edited memory as its own. agmi measures whether anything in that read, or in a later audit, notices.
How one cell is measured
Seed through the tool's own API, apply one edit behind its back, reopen the store the way its users would, read through the tool's own read path, record what it said. Three controls run before any verdict counts.
Where to go next
- 1What an attacker can doFifteen edits and attacks, each drawn and explained
- 2How a cell is measuredThree controls before any verdict counts
- 3What each store doesOne page per store, the tool's own words per cell
- 4What a level meansFive levels a vendor can claim and link
- 5Run it on yoursOne CI step, under a minute, offline
The board
Rows are stores, columns are edits. Click a cell for what the tool said; click a row for its page.
- accepted
- the tool loaded the altered store and served the edit as genuine
- reported
- the read path served it; a separate audit call flagged it
- rejected
- the read path refused or flagged it before the agent could act on it
- n/a
- the edit does not apply to this store, or the cell is not yet measured
If you ship a memory store
Put the nine edits in CI as one step. memory-blackbox and MythologIQ already run them against every release.
If you build agents
Pick the store by its row, not its README. A served edit means the agent acts on it first and nobody finds out.
If you write standards
The method is an Internet-Draft in the IETF BMWG and the proposed test for OWASP's memory integrity control.
The memory agent
Beyond the fixed scorecard, agmi ships an agent that hunts: point it at one store and it searches six attacks, three channels and the content mutations for the first that gets a false memory served as trusted, proves the landing against a positive control, and hands back a reproduction script. Against every real store measured it walked in on the first attempt; only the defended reference store made it search. It runs behind an authorisation gate that fails closed. How it works.
Latest findings
- A managed cloud store joins the table: Vertex AI Memory Bank serves seven edits, two have no API
- First row to refuse all eight record-level edits on the read path: the Agent Memory reference runtime
- T9, a rollback of the whole store that every digest still passes
- A vendor fix driven by the suite: memory-blackbox restart gap, reported and fixed in a day
Five levels a store can claim
A level is a set of edits rejected on the read path, in the order attackers reach for them. Vendors can claim one and link the row that earns it.