agmiAgent Memory Integrity GitHub

Store, measured at rest

Agent Memory reference runtime

SQLite canonical substrate, bucketed row digests, fail-closed open

Agent Memory reference runtime was seeded through its own API and edited behind its back nine ways. 1 edit served as genuine, 0 reported on audit, 8 rejected on read.

T1rejectedT2rejectedT3rejectedT4rejectedT5rejectedT6rejectedT7rejectedT8rejectedT9served
Measured on
agent-memory-reference 0.2.0 (f2aef57), Darwin arm64, Python 3.12
Date
Source
github.com/MythologIQ-Labs-LLC/agent-memory
Attack versions
tamper@v1, truncate@v1, delete_middle@v1, reorder@v1, forge@v1, cross_replay@v1, rollback_replay@v1, metadata_tamper@v1, snapshot_rollback@v1

What this means

The read path itself refuses 8 of the nine edits before the agent can act on them; 1 are still served. The cells that are served are where an attacker with the store would go next.

The 9 verdicts

Detection point: the read path: the tool itself refuses or flags the edit before the agent can act on it.

Level L3, Context bound. Also rejects a record moved between owners and a metadata change: T6, T8. What L3 means.

EditVerdictWhat the tool said
T1
Content tamper		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T2
Tail truncation		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T3
Middle deletion		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T4
Reordering		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T5
Forged insertion		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T6
Cross-context replay		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T7
Rollback replay		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T8
Metadata tamper		rejecteddetected on reload (RuntimeRecoveryError: SQLite canonical substrate digest mismatch)
T9
Snapshot rollback		acceptedthe older copy opened as current; the newest genuine record is gone without an error

A verdict is what the tool did, not an opinion. "Accepted" means it loaded the altered store, raised nothing, and the agent carried on from the altered memory as if it were true. Every cell has a control that proves the edit landed before the verdict counts.

Where the attacker stands

The attacker holds the store (a file, a table, a bucket, or the data-plane role of a managed service) and edits it outside the tool's API, then the tool is reopened the way its users would reopen it.

Where the attacker stands The agent write pathremember, add, put read pathrecall, search, resume memory store Front doorcan only talk to the agentsix attacks, three channels At restcan write to the store, holds no keysnine edits, T1 to T9 What agmi recordswhat came back from the read paththe tool's own verdict, its detail,the version, the reproduction
Two attacker positions. The front-door attacker writes through the agent and is scored on whether the planted memory comes back as context. The at-rest attacker edits the store directly and is scored on whether the tool notices on read.

Reproduce this row

Everything runs offline unless the store is a managed cloud service, in which case the row needs a project of your own. The run seeds a fresh store, applies each edit, confirms it landed, reopens the store and records what came back.

pip install agent-memory-integrity
python agmi/full_runner.py --json results/scorecard.json   # every row, this one included

Badge

Maintainers can link their row from their README. The badge points here and changes nothing on your side:

[![agmi: measured](https://img.shields.io/badge/agmi-measured-0F4C5C)](https://agentmemoryintegrity.org/stores/agent-memory.html)

Related rows

    The whole scorecard · All stores