agmiAgent Memory Integrity GitHub

At-rest edit T10

Erasure resurrection

The tool erases a record through its own API; the attacker puts back the copy of the store taken before the erasure.

What it looks like in the world: A deletion request was honoured, and then last night's backup came back. Nothing is forged; the store is just one record richer than it should be. A ledger of what must be present does not see it.

attack id erase_resurrect · version 1 · attacker: store-access

The edit, drawn

T10 Erasure resurrection

The user asked for a record to be erased and the tool erased it. The attacker restores the copy of the store he took before the erasure, sidecar files and all.

Beforeuser BB0B1B2B3B4 erased through the tool's own API,at the user's requestThe edituser BB0B1B2B3B4B4 back; every byte is as the store once wrote itWhat the agent reads backThe erased record is served again.Every digest, chain link and ledgerentry still checks out, because theledger lists what must be present.

What stops it

A head that moved past the erasure and is kept where the restore cannot reach it: a witness on another machine, an anchor held off the store. The restored copy is then behind the head, and the read refuses.

What does not

A ledger of what must be present, including one that catches a whole-store rollback: after the restore, every record it ever recorded is present again. T10 is not yet placed on the levels ladder; the draft that defines the levels has not placed it.

Today, measured 2026-10-19

rejected on read
Recallspection ExactMemory, anchored, anchor off the store, on a separate volume or a remote service
accepted
LangGraph SqliteSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, Mem0 local Qdrant store, langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, Recallspection ExactMemory, anchor beside the store on the same disk, the default the product ships

agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T10

Every store, this edit

accepted 6

rejected 1

n/a 25

Reproduce

pip install agent-memory-integrity
python agmi/full_runner.py --json results/scorecard.json   # every row; the erase_resurrect column is this page

All 16 edits and attacks · The scorecard