Fifteen ways to change what an agent remembers. Nine need access to the store and are the at-rest edits, T1 to T9. Six only need to talk to the agent and are the front-door attacks. Each one below has a story, a picture of what changes, what the agent reads back, what stops it, and which stores stop it today.
Eight edits on two users' histories. T1, T5 and T8 change or add bytes. T2 and T3 remove them. T4, T6 and T7 move only genuine bytes, which is why encryption and per-record signatures do not catch them.
At rest: the attacker can write to the store
T1 Content tamper
The user told the agent last week that the wire goes to account 4471. The attacker opens the store and changes one number inside that record. Nothing else moves.
What stops it
Any authentication over each record's bytes: a MAC, a signature or an authenticated cipher. This is the edit every defence catches first.
What does not
Plain encryption without authentication, and any store that only checks that the record still parses.
Today, measured 2026-10-07
rejected on read
OpenFang model, tip-persistence fix, acrf-memory-guard, per-entry HMAC over a JSON store, Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed open
reported on audit
inspeximus, receipts on, attacker holds the store directory, inspeximus, receipts on, attacker also holds the config home, langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, memory-blackbox memory.md watcher, agent process alive, scan audit, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain, verify_chain audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain, verify_events audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit
accepted
LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Vertex AI Agent Engine Memory Bank, managed store, edits through the data-plane API, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), AtMem 2.3.7, audit chain alone, verify() audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit
agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T1
T2 Tail truncation
The agent made two decisions yesterday. The attacker deletes both records, so the newest record is now the one from the day before.
What stops it
A signed head pointer: the store must know which record is supposed to be newest, not just that each record is valid.
What does not
Per-record signatures and per-record encryption, because every record left is genuine.
inspeximus, receipts on, attacker holds the store directory, inspeximus, receipts on, attacker also holds the config home, langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, memory-blackbox memory.md watcher, agent process alive, scan audit, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain, verify_chain audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain, verify_events audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit
accepted
LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), AtMem 2.3.7, audit chain alone, verify() audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit, acrf-memory-guard, per-entry HMAC over a JSON store
agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T4
T5 Forged insertion
The attacker writes a brand-new record in the store's own format, with a valid-looking id and the right parent, saying the user approved something.
What stops it
A key the attacker does not hold: records are signed or MACed with something that is not in the store directory.
What does not
Stores where the only check is that the record is well formed.
Today, measured 2026-10-07
rejected on read
OpenFang model, tip-persistence fix, acrf-memory-guard, per-entry HMAC over a JSON store, Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed open
reported on audit
inspeximus, receipts on, attacker holds the store directory, inspeximus, receipts on, attacker also holds the config home, memory-blackbox memory.md watcher, agent process alive, scan audit, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain, verify_chain audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain, verify_events audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit
accepted
LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Vertex AI Agent Engine Memory Bank, managed store, edits through the data-plane API, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, AtMem 2.3.7, audit chain alone, verify() audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit
agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T5
T6 Cross-context replay
User A's memory says their password hint. The attacker copies A's genuine record over one of user B's, keeping B's ids. Every byte, including its signature, is real.
What stops it
The owning context inside the authenticated data: the tag must cover whose record this is and which thread it belongs to.
What does not
Encrypted checkpointers and per-record signatures that do not bind the record to its owner. This is the edit that separates real integrity from encryption.
inspeximus, receipts on, attacker holds the store directory, inspeximus, receipts on, attacker also holds the config home, langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, memory-blackbox memory.md watcher, agent process alive, scan audit, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain, verify_chain audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain, verify_events audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit
accepted
LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Vertex AI Agent Engine Memory Bank, managed store, edits through the data-plane API, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), AtMem 2.3.7, audit chain alone, verify() audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit, acrf-memory-guard, per-entry HMAC over a JSON store
agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T7
T8 Metadata tamper
A record from an untrusted web page sits in the store marked source: web. The attacker changes that one tag to source: user and touches nothing else.
What stops it
Metadata inside the authenticated data: owner, source and time are covered by the same tag as the content.
What does not
Every store that signs content and keeps metadata as plain columns.
Today, measured 2026-10-07
rejected on read
acrf-memory-guard, per-entry HMAC over a JSON store, Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed open
reported on audit
inspeximus, receipts on, attacker holds the store directory, inspeximus, receipts on, attacker also holds the config home, memory-blackbox memory.md watcher, agent process alive, scan audit, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain, verify_chain audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain, verify_events audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit
accepted
LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Vertex AI Agent Engine Memory Bank, managed store, edits through the data-plane API, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, AtMem 2.3.7, audit chain alone, verify() audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit
agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T8
T9 Snapshot rollback
The agent approved a transfer an hour ago. The attacker restores last night's backup of the whole store, sidecar files and all.
What stops it
A head the attacker cannot restore with the files: a witness on another machine, a receipt held elsewhere, a transparency log.
What does not
Every store that keeps its head beside its records, including ones that reject all of T1 to T8.
Today, measured 2026-10-07
reported on audit
inspeximus, receipts on, attacker holds the store directory, langgraph-ledger over SqliteSaver, hash-chained ledger, verify_thread audit, memory-blackbox memory.md watcher, agent process alive, scan audit, Atelya Attest, keyed hash chain plus anchored head, verify and consistency audit, CONTINUUM event log, hash chain plus Ed25519-signed head, attest-verify audit, AtMem 2.3.7, audit chain with an external checkpoint outside the attacker-controlled store directory, verify() audit
accepted
OpenFang model, tip-persistence fix, LangGraph SqliteSaver, LangGraph PostgresSaver, LangGraph RedisSaver, OpenAI Agents SDK SQLiteSession, LlamaIndex Memory, SQLAlchemy chat store, CrewAI long-term memory, LanceDB dataset, Letta block checkpoint history, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, receipts on, attacker also holds the config home, memory-blackbox memory.md watcher, agent restarted before the scan, scan audit, Atelya Attest, keyed hash chain, verify_chain audit, CONTINUUM event log, hash chain, verify_events audit, AtMem 2.3.7, audit chain alone, verify() audit, acrf-memory-guard, per-entry HMAC over a JSON store, Agent Memory reference runtime, SQLite canonical substrate, bucketed row digests, fail-closed open
agmi-check --adapter agmi.adapters.langgraph_sqlite:LangGraphSqliteAdapter # runs T1 to T8; this is T9
Front door: the attacker can only talk to the agent
Three ways in through the front door. Provenance stops the first, an attested key stops the second, and no store can close the third, because the agent itself is the writer. Every write also runs as its content mutations.
Planted fact
Write a false fact through the tool's own API and see whether recall serves it as the user's own.
The cheapest attack there is: talk to the agent and wait.
surfaced
LangGraph SqliteStore, Letta archival memory, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, trust root keyed on the label, inspeximus, trust root keyed on an attested key, Reference store, user-scoped, Reference store, unscoped, Reference store, defended
Cross-user leak
Write as one user, read as another.
The only cell that holds anywhere, and it holds for a tool-specific reason each time.
kept out
LangGraph SqliteStore, Letta archival memory, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, trust root keyed on the label, inspeximus, trust root keyed on an attested key, Reference store, user-scoped, Reference store, defended
surfaced
Reference store, unscoped
Retrieval hijack
Stuff an entry with a topic's question words so it outranks the genuine memory.
The read path ranks by similarity and nothing else.
kept out
Reference store, defended
surfaced
LangGraph SqliteStore, Letta archival memory, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, trust root keyed on the label, inspeximus, trust root keyed on an attested key, Reference store, user-scoped, Reference store, unscoped
Hidden instruction
Store an instruction disguised as a memory and see whether it comes back as context.
A memory that tells the agent what to do next.
kept out
Reference store, defended
surfaced
LangGraph SqliteStore, Letta archival memory, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, trust root keyed on the label, inspeximus, trust root keyed on an attested key, Reference store, user-scoped, Reference store, unscoped
Update poisoning
Write a 'correction' of a fact the user stated.
Every real tool serves the correction alongside the original.
surfaced
LangGraph SqliteStore, Letta archival memory, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, trust root keyed on the label, inspeximus, trust root keyed on an attested key, Reference store, user-scoped, Reference store, unscoped, Reference store, defended
Metadata poisoning
Self-assign the trust tag a pipeline filters on.
Every tool with a filter let the self-tagged memory through.
surfaced
LangGraph SqliteStore, Mem0 local Qdrant store, inspeximus, receipts off (default), inspeximus, trust root keyed on the label, inspeximus, trust root keyed on an attested key, Reference store, user-scoped, Reference store, unscoped, Reference store, defended
Every attack carries a version, printed by the runner and stored with each result, so cells from different reports are never compared as if the attack had stood still. Front-door attacks also run as content-evasion mutations: reworded, look-alike glyphs, split across records, diluted with filler. A positive control runs before every verdict: the victim reads back a genuine memory in the same store state, or the cell is not evaluable.
