MemoryDojo finds AI agent memory poisoning outlasts attack

Every AI agent memory system tested in a new benchmark could be poisoned by an instruction planted in an earlier session. MemoryDojo, a paper posted to arXiv on 6 November by researchers at Microsoft and Rensselaer Polytechnic Institute, traces what happens when an agent stores a malicious instruction and acts on it later.

Prompt injection is usually described as a single moment: an agent reads a hostile email or web page and does something it should not. Memory stretches that moment. The paper’s example is an email telling an agent to forward invoices to an attacker. If the agent files the instruction as the user’s preference, it can apply it to future invoices long after the email has left its view.

The benchmark runs 155 multi-session tasks across four domains and five open-source memory systems, among them linked notes, a knowledge graph and a hierarchical store. It follows whether the poison is written to memory, retrieved in later sessions and acted upon. The authors report that all five systems were susceptible, with large differences in effect, and that payloads tuned to a particular memory system raised attack success by approximately 2 to 31 per cent.

This is a controlled test. It does not show that commercial agents are being compromised at these rates, and the authors leave defences to future work. Its value lies in moving attention from the prompt to the store. A model that refuses a suspicious instruction today can still retrieve a corrupted note tomorrow, so the controls that matter sit around memory itself: what may be written to it, and where each entry came from. Watch whether agent makers start publishing those rules.

Sources: arXiv (Yang, Bullwinkel, Minnich, Amiri and Severi).