Agent Memory Consolidation Launders Attacker Instructions

Agent memory consolidation launders attacker fingerprints, letting an injected instruction resurface later disguised as user history, per the paper.

When an agent folds an external observation into long-term memory, the rewrite step keeps the action. But it drops the low-trust source, so the instruction reads back like something the user actually asked for. That laundering hit a 1.000 attack success rate in testing. Every injected instruction that made it into memory got carried out later as if it had legitimate authority behind it.

The paper's proposed fix is a Provenance-Preserving Memory Firewall, described as lightweight middleware. It keeps platform-controlled provenance metadata attached to every memory. It assigns a risk label to each action an agent wants to take. Then it gates tool execution by checking that risk against the authority of whatever memory is backing the request. With provenance intact, zero unauthorized high-risk actions got through the gate, and benign actions stayed executable.

The paper doesn't say what happens to memories laundered before a firewall like this goes in. It also doesn't say what the provenance check costs to run on every tool call in production.

The take

Most memory systems decide what to trust by reading what a memory says, not by checking who put it there. That's backwards. It's the same blind spot as a related finding: single-turn guardrail tests overstate how well an agent holds up under a multi-turn attack. Provenance stamped at write time is cheap. Inferring trust at read time, after the source is already gone, is guessing.