Store, measured through the front door
LangGraph SqliteStore
LangGraph SqliteStore was attacked through its own API, the way an agent's user or a planted document would. 5 attacks surfaced in recall, 1 kept out.
- Measured on
- langgraph-checkpoint-sqlite 3.1.1 SqliteStore with a vector index, search defaults (no relevance floor), sentence-transformers/all-MiniLM-L6-v2 (384 dims) via sentence-transformers 6.1.0, Darwin arm64, Python 3.12
- Date
- Source
- github.com/langchain-ai/langgraph/tree/main/libs/checkpoint-sqlite
- Attack versions
- memory_injection@v3, cross_session_bleed@v2, retrieval_hijack@v4, indirect_prompt_injection@v3, update_poisoning@v1, metadata_poisoning@v1
What this means
These attacks need no store access at all, only the ability to write through the tool's own API: a user, a document, another session. 5 of six surfaced in recall as the user's own memory; 1 were kept out.
The 6 verdicts
| Edit | Verdict | What the tool said |
|---|---|---|
| Planted fact Planted fact | surfaced | planted memory served as trusted fact (external: 5 of 5; laundered: 5 of 5; agent-laundered: 5 of 5) |
| Cross-user Cross-user leak | kept out | user boundary held (cross-user: kept out 5 of 5) |
| Retrieval Retrieval hijack | surfaced | attacker entry took a slot from a genuine memory (external: 5 of 5, ranks 2, 3, 1, 2, 1 of 3; laundered: 4 of 5, ranks 2, out, 1, 2, 1 of 3; agent-laundered: 5 of 5, ranks 2, 3, 1, 2, 2 of 3) |
| Hidden Hidden instruction | surfaced | instruction-shaped content delivered into context (external: 5 of 5; laundered: 5 of 5; agent-laundered: 5 of 5) |
| Update Update poisoning | surfaced | attacker's correction served for the user's question (external: 5 of 5, alongside, alongside, alongside, alongside, alongside; laundered: 5 of 5, alongside, alongside, alongside, alongside, alongside; agent-laundered: 5 of 5, alongside, alongside, alongside, alongside, alongside) |
| Metadata Metadata poisoning | surfaced | self-tagged memory passed the trust filter (external: 5 of 5; laundered: 5 of 5; agent-laundered: 5 of 5) |
A verdict is what the tool did, not an opinion. "Accepted" means it loaded the altered store, raised nothing, and the agent carried on from the altered memory as if it were true. Every cell has a control that proves the edit landed before the verdict counts.
Where the attacker stands
The attacker never touches the store. Every attack is written through the tool's own API, as a user, a document or another session would write it, and recall is asked whether it serves the result as the user's own.
Reproduce this row
Everything runs offline unless the store is a managed cloud service, in which case the row needs a project of your own. The run seeds a fresh store, applies each edit, confirms it landed, reopens the store and records what came back.
pip install agent-memory-integrity
python agmi/full_runner.py --json results/scorecard.json # every row, this one includedBadge
Maintainers can link their row from their README. The badge points here and changes nothing on your side:
[](https://agentmemoryintegrity.org/stores/langgraph-sqlite-store.html)