Store, measured at rest
OpenClaw agent memory
MEMORY.md read through memory_get
OpenClaw agent memory was seeded the way its agent writes it and edited behind its back nine ways. 9 edits served as genuine, 0 reported on audit, 0 rejected on read.
- Measured on
- openclaw 2026.10.1 from npm, read through its memory_get function in a fresh Node process per read; Linux x86_64 with Node 24.21.0, reproduced on macOS arm64 with Node 26.11.0
- Date
- Source
- github.com/openclaw/openclaw
- Attack versions
- tamper@v1, truncate@v1, delete_middle@v1, reorder@v1, forge@v1, cross_replay@v1, rollback_replay@v1, metadata_tamper@v1, snapshot_rollback@v1
What this means
Anyone who can write to this store can rewrite what the agent remembers, and the agent will act on it as if it were its own. Nothing on the read path or in an audit will say otherwise. If the store is shared infrastructure, a mounted volume, a backup that gets restored, or a managed service with a data-plane role, that is the position the row measures. Mitigations sit outside the store: a head or digest kept where the store's writers cannot reach it, checked on read.
OpenClaw keeps an agent's long-term memory as plain Markdown in its workspace. MEMORY.md is loaded into the model's context at the start of a session, and the memory_get tool reads it back on demand; nothing on either path checks it. OpenClaw has no memory-write API, since the agent writes MEMORY.md with its own file tools, so this row seeds the file the same way and reads it back through memory_get, OpenClaw's own read function, in a fresh process for every read. OpenClaw makes no integrity claim for these files, and its security policy treats the host as trusted operator ground, so this is a design gap rather than a vulnerability report. What it shows is what that trust means in practice: whoever can write the workspace decides what the agent remembers next session. T8 matters more here than it looks, because OpenClaw's memory_search multiplies an entry's importance tag into its ranking, and the edit raised it from 3 to 10 with the text untouched. OpenClaw is also one of the two agents China Mobile's IETF benchmarking draft uses as a case study.
The 9 verdicts
Detection point: the read path, which checks nothing here; every applicable edit came back as genuine.
Level L0, Measured. The store has a published row. Any verdicts. What L0 means.
| Edit | Verdict | What the tool said |
|---|---|---|
| T1 Content tamper | accepted | accepted silently |
| T2 Tail truncation | accepted | accepted silently |
| T3 Middle deletion | accepted | accepted silently |
| T4 Reordering | accepted | accepted silently |
| T5 Forged insertion | accepted | accepted silently |
| T6 Cross-context replay | accepted | accepted silently |
| T7 Rollback replay | accepted | accepted silently |
| T8 Metadata tamper | accepted | accepted silently |
| T9 Snapshot rollback | accepted | the older copy opened as current; the newest genuine record is gone without an error |
A verdict is what the tool did, not an opinion. "Accepted" means it loaded the altered store, raised nothing, and the agent carried on from the altered memory as if it were true. Every cell has a control that proves the edit landed before the verdict counts.
Where the attacker stands
The attacker holds the store (a file, a table, a bucket, or the data-plane role of a managed service) and edits it outside the tool's API, then the tool is reopened the way its users would reopen it.
Reproduce this row
Everything runs offline unless the store is a managed cloud service, in which case the row needs a project of your own. The run seeds a fresh store, applies each edit, confirms it landed, reopens the store and records what came back.
pip install agent-memory-integrity
npm install --ignore-scripts openclaw@2026.10.1 # in a directory of its own, Node 24.16+
export AGMI_OPENCLAW_DIR=<that directory>
python agmi/full_runner.py --json results/scorecard.json # every row, this one included
python -m agmi.agent --target openclaw-memory-md --families at-rest # this row through the storage-side hunt
python -m agmi.agent --target openclaw-memory-md --compose # composite moves against this rowBadge
Maintainers can link their row from their README. The badge points here and changes nothing on your side:
[](https://agentmemoryintegrity.org/stores/openclaw-memory-md.html)