agmiAgent Memory Integrity GitHub

Store, measured at rest

OpenFang model

tip-persistence fix

OpenFang model was seeded through its own API and edited behind its back nine ways. 1 edit served as genuine, 0 reported on audit, 5 rejected on read, 3 not applicable.

T1rejectedT2rejectedT3rejectedT4rejectedT5rejectedT6n/aT7n/aT8n/aT9served
Measured on
reference model of a hash chain, Darwin arm64, Python 3.12
Date
Source
github.com/RightNow-AI/openfang
Attack versions
tamper@v1, truncate@v1, delete_middle@v1, reorder@v1, forge@v1, cross_replay@v1, rollback_replay@v1, metadata_tamper@v1, snapshot_rollback@v1

What this means

The read path itself refuses 5 of the nine edits before the agent can act on them; 1 are still served. The cells that are served are where an attacker with the store would go next.

The 9 verdicts

Detection point: the read path: the tool itself refuses or flags the edit before the agent can act on it.

Level L1, Bytes bound. Rejects on the read path every edit that changes or adds bytes: T1, T3, T5. What L1 means.

EditVerdictWhat the tool said
T1
Content tamper		rejecteddetected on reload (hash mismatch at seq 2)
T2
Tail truncation		rejecteddetected on reload (walked tip differs from persisted tip)
T3
Middle deletion		rejecteddetected on reload (chain break at seq 3)
T4
Reordering		rejecteddetected on reload (chain break at seq 1)
T5
Forged insertion		rejecteddetected on reload (chain break at seq 5)
T6
Cross-context replay		n/aadapter does not model a second context
T7
Rollback replay		n/aadapter does not support replay
T8
Metadata tamper		n/aadapter does not expose record metadata
T9
Snapshot rollback		acceptedthe older copy opened as current; the newest genuine record is gone without an error

A verdict is what the tool did, not an opinion. "Accepted" means it loaded the altered store, raised nothing, and the agent carried on from the altered memory as if it were true. Every cell has a control that proves the edit landed before the verdict counts.

Where the attacker stands

The attacker holds the store (a file, a table, a bucket, or the data-plane role of a managed service) and edits it outside the tool's API, then the tool is reopened the way its users would reopen it.

Where the attacker stands The agent write pathremember, add, put read pathrecall, search, resume memory store Front doorcan only talk to the agentsix attacks, three channels At restcan write to the store, holds no keysnine edits, T1 to T9 What agmi recordswhat came back from the read paththe tool's own verdict, its detail,the version, the reproduction
Two attacker positions. The front-door attacker writes through the agent and is scored on whether the planted memory comes back as context. The at-rest attacker edits the store directly and is scored on whether the tool notices on read.

Reproduce this row

Everything runs offline unless the store is a managed cloud service, in which case the row needs a project of your own. The run seeds a fresh store, applies each edit, confirms it landed, reopens the store and records what came back.

pip install agent-memory-integrity
python agmi/full_runner.py --json results/scorecard.json   # every row, this one included

Badge

Maintainers can link their row from their README. The badge points here and changes nothing on your side:

[![agmi: measured](https://img.shields.io/badge/agmi-measured-0F4C5C)](https://agentmemoryintegrity.org/stores/openfang-model-fixed.html)

Related rows

    The whole scorecard · All stores