https://agentmemoryintegrity.org/findings/Dated findings from the agent memory integrity scorecard.enhttps://agentmemoryintegrity.org/findings/a-managed-cloud-store-joins-the-table-vertex.htmlhttps://agentmemoryintegrity.org/findings/a-managed-cloud-store-joins-the-table-vertex.htmlWed, 07 Oct 2026 09:00:00 +0000The first managed store on the board. There is no disk, so the attacker is a principal holding roles/aiplatform.user on the project outside the agent's session, editing through memories.patch, memories.delete and memories.create. Content tamper, truncation, middle delete, forgery, cross-context replay, rollback replay and metadata tamper are all served as genuine on the next retrieve. Reorder and whole-store rollback score n/a: the API cannot set create_time, and a managed store exposes no snapshot or restore of its own state. Memory Bank records a revision for every change to a memory's fact, so an edit is discoverable by an investigator afterwards; nothing on the read path consults it. Google makes no integrity claim for the store, so this is a reference measurement rather than a vulnerability: the same shape as the frameworks, now with a cloud provider in the same table.https://agentmemoryintegrity.org/findings/first-row-to-refuse-all-eight-record-level-edits.htmlhttps://agentmemoryintegrity.org/findings/first-row-to-refuse-all-eight-record-level-edits.htmlTue, 06 Oct 2026 09:00:00 +0000Every canonical SQLite row is hashed into a bucketed Merkle digest, the governance log is chained, and open() fails closed on any mismatch, so T1 to T8 are refused before the agent reads anything. T9, the rollback of the whole store to an older genuine copy, is served: the generation anchor sits in a sidecar beside the database, so the restored copy opens as current with the newest memory gone. The maintainers accepted the row as external integrity evidence for T1 to T9 and pin the suite in their own CI (#639, #650).https://agentmemoryintegrity.org/findings/t9-a-rollback-of-the-whole-store-that.htmlhttps://agentmemoryintegrity.org/findings/t9-a-rollback-of-the-whole-store-that.htmlTue, 06 Oct 2026 09:00:00 +0000Restore an older complete copy of everything the store keeps on disk, taken before one more genuine record was written through the tool's own API. Every byte in the restored copy is genuine; only the newest record is missing. Served by the three LangGraph checkpointers, OpenAI Agents SDK, LlamaIndex, CrewAI, Letta, Mem0, acrf-memory-guard, the chain-only Atelya and CONTINUUM rows, the OpenFang model, the Agent Memory reference runtime, inspeximus with receipts off or with the config home in the attacker's hands, and memory-blackbox restarted. Reported only by the rows that hold a head off the store: langgraph-ledger, Atelya anchored, CONTINUUM attested, inspeximus with receipts on and the config home out of reach, and memory-blackbox with the watcher alive. The composition engine shipped in the same release found that the reference store's own genuine write re-anchored its witness to a truncated chain, so truncate-then-write laundered a deletion; the witness now advances only forward.https://agentmemoryintegrity.org/findings/a-vendor-fix-driven-by-the-suite-memory-blackbox.htmlhttps://agentmemoryintegrity.org/findings/a-vendor-fix-driven-by-the-suite-memory-blackbox.htmlFri, 02 Oct 2026 09:00:00 +0000With the agent process alive, the memory-blackbox memory.md watcher reports all eight edits on scan. With the agent restarted between the edit and the scan, 0.1.0 served all eight: baseline() seeded the watcher from the file bytes, so an edit made while the agent was down became the trusted state. The maintainer was told privately under the project's security policy on the morning of 2 October; the restart row was held back from the scorecard meanwhile. The fix shipped as 0.1.1 the same day: baseline() now takes the ledger's last write for each watched file as the trusted state, a file the ledger has never seen is recorded once so a cold start reads differently from a mismatch, and the maintainer ran the suite against the fix before tagging. Re-measured on 0.1.1, both rows report all eight. The repo now has private vulnerability reporting switched on and credits the report in its release notes and SECURITY.md.https://agentmemoryintegrity.org/findings/the-suite-catches-two-of-its-own-no-op.htmlhttps://agentmemoryintegrity.org/findings/the-suite-catches-two-of-its-own-no-op.htmlWed, 30 Sep 2026 09:00:00 +0000The inspeximus maintainer found that on the inspeximus and Mem0 rows the T6 cross-context replay was a no-op: the victim pool was read from both contexts, so the donor was copied onto itself and the cell scored as accepted on an edit that never happened. The earlier finding that a receipt does not bind the owning user rested on that no-op and is withdrawn; with the pool scoped to the first context, both receipt rows report T6. A third control now runs before every verdict: each attack proves its edit landed as intended, and a cell whose edit did not land reads error. That control also found the Mem0 T4 reorder was a no-op (the adapter wrote each point back under its own id); fixed, and Mem0 still accepts it on a real swap. Those cells read error until the scoped victim pool lands.https://agentmemoryintegrity.org/findings/head-deletion-needs-an-anchor-outside-the-store.htmlhttps://agentmemoryintegrity.org/findings/head-deletion-needs-an-anchor-outside-the-store.htmlWed, 30 Sep 2026 09:00:00 +0000Binding a record to its place (#9004) cannot see a record that has been removed, so deleting the newest checkpoints still rolls a thread back silently. A community reference implementation lets the caller pass the id of the head it trusts; with it set, head deletion raises on both the sync and async checkpointers, and merged with the #9004 fix the rollback-by-overwrite case is rejected as well. Measured with the suite on both paths; the history view is not covered by the anchor and that is on record.https://agentmemoryintegrity.org/findings/six-of-six-stores-accept-all-eight-at-rest.htmlhttps://agentmemoryintegrity.org/findings/six-of-six-stores-accept-all-eight-at-rest.htmlSun, 27 Sep 2026 09:00:00 +0000OpenAI Agents SDK SQLiteSession and LlamaIndex Memory join LangGraph SqliteSaver, Letta block history, Mem0 local Qdrant and inspeximus in its default configuration: every one of the eight storage-level edits is served as genuine, and none of the six checks anything on read. OpenAI closed its issue with a documentation change stating the session store trusts its storage; LlamaIndex has a documentation note in review and the issue stays open for an integrity option.https://agentmemoryintegrity.org/findings/four-of-four-stores-accept-all-eight-at-rest.htmlhttps://agentmemoryintegrity.org/findings/four-of-four-stores-accept-all-eight-at-rest.htmlFri, 25 Sep 2026 09:00:00 +0000LangGraph SqliteSaver, Letta block history, Mem0 local Qdrant and inspeximus in its default configuration all serve every one of the eight storage-level edits as genuine. None of the four checks anything on read.https://agentmemoryintegrity.org/findings/withdrawn-a-receipt-does-not-bind-the-owning.htmlhttps://agentmemoryintegrity.org/findings/withdrawn-a-receipt-does-not-bind-the-owning.htmlFri, 25 Sep 2026 09:00:00 +0000This finding is withdrawn as of 2026-09-30, see the entry above. The T6 edit on the inspeximus rows had not actually crossed contexts, so the cell measured nothing. With a real crossing, the receipts report it.https://agentmemoryintegrity.org/findings/encryption-without-identity-binding-langgraph-9004.htmlhttps://agentmemoryintegrity.org/findings/encryption-without-identity-binding-langgraph-9004.htmlThu, 24 Sep 2026 09:00:00 +0000LangGraph's EncryptedSerializer authenticates the ciphertext but not the record's place, so a genuine encrypted checkpoint from one thread verifies in another (T6) and an older one verifies over the newest (T7). A proposed fix binding thread, checkpoint id and channel as AEAD associated data rejects both; deleting the head row (T2) still rolls the thread back, because binding a record to its place cannot see a record that has been removed.https://agentmemoryintegrity.org/findings/a-vendor-fix-caught-by-re-measurement-inspeximus-3-5-2.htmlhttps://agentmemoryintegrity.org/findings/a-vendor-fix-caught-by-re-measurement-inspeximus-3-5-2.htmlTue, 22 Sep 2026 09:00:00 +0000After the maintainer shipped a write-time quarantine and a stuffing penalty, the hidden-instruction and retrieval-hijack cells moved from surfaced on all five fixtures to surfaced on one and two. The cells stay surfaced, since a tool is kept out only when the attacker wins none, but the defence is engaging and the change is on record.https://agentmemoryintegrity.org/findings/a-forward-only-hash-chain-misses-truncation-openfang.htmlhttps://agentmemoryintegrity.org/findings/a-forward-only-hash-chain-misses-truncation-openfang.htmlMon, 14 Sep 2026 09:00:00 +0000A chain that walks forward from the first record verifies every link and never notices that the last two are gone. Persisting the tip closes exactly that gap. This was the first result the suite produced and the reason the reference model exists.