Your agent remembers everything. An attacker can rewrite it.

Poisoned in every system tested

MemoryDojo, a preprint, traces malicious information through agent memory. It found all evaluated memory systems susceptible to memory poisoning. A memory-aware method for crafting the poison increased the efficacy of the attacks. m:…7594

The damage is not uniform: downstream effects of poisoning vary significantly across different memory architectures — so the same poison does different damage depending on how the agent stores what it has learned. m:…7594

The fixes on offer

Two other preprints offer better memory, not safer memory. ENGRAM separates training admission from memory release to manage agent experience consolidation, using two gates: one admits skills based on student mastery or sufficient teacher demonstrations, and a second compares updated model performance against the base model with retrieval to validate memory release. It reduces the retrievable footprint while maintaining performance, and improves task performance while cutting input-token use and model calls. m:…7581

MemSkill takes a different route, treating memory operations — extraction, consolidation, pruning — as learnable skills rather than fixed procedures. Reframing memory operations as learnable skills allows agents to adapt to diverse interaction patterns more effectively than fixed procedures, and a designer reviews hard cases where memory operations fail and evolves the skill set. It improved task performance over static memory baselines on LoCoMo, LongMemEval, HotpotQA and ALFWorld. Neither paper claims to defend against poisoning: both are measured on performance and efficiency, and neither was tested against an attacker planting false memories. m:…5105

Control on paper, limits in practice

A fourth preprint offers a formal control framework. Jacobian-causal memory control, or JCMC, represents authorised memory interventions through predicted influence signatures in a shared behavioral measurement space, and includes a rollback mechanism that compares predicted versus observed effects to manage memory persistence. It also provides a quadratic local-approximation bound for memory interventions under explicit smoothness and bounded-estimation assumptions, and defines an evaluation protocol comparing the approach against relevance, graph and policy-filtered retrieval baselines. But the paper is theoretical: it reports no benchmark measurements and provides no code, so the control exists as mathematics, not as a tested defence. m:…5113

The framework is designed to manage persistent memory interventions by predicting their influence before applying them: each authorised intervention is represented by a predicted influence signature, with a rollback mechanism that compares predicted versus observed effects to manage memory persistence. That is a serious design for memory control — but it is presented as theory with mathematical bounds, not as a system anyone has run. m:…5113

The performance picture is no better. EGOSTREAM, a diagnostic benchmark for streaming episodic memory in egocentric vision, enables controlled testing of episodic memory from instant to ultra-long-term recall by separating model forgetting from world-state changes via the Answer Validity Window. Token pruning preserved fine-grained detail and temporal structure better than token merging, and adaptive head budgets gave the highest aggregate semantic accuracy — but every in-cache memory policy tested ran below real time, taking more than a second per frame. The memory stack agents depend on is both poisonable and slow. m:…0842

The pattern across all five papers is the same: memory is the weak layer. Every system MemoryDojo tested can be poisoned, the frameworks that improve memory do not defend it, the formal control has no measurements behind it, and the streaming benchmark shows every in-cache policy running below real time. An agent that remembers everything is an agent an attacker can rewrite — and a slow one, too. m:…7594 m:…0842