Long-term memory makes AI agents more useful. It also turns yesterday's conversation into part of tomorrow's trusted context.
Our April 2026 graduate course research project in UBC CPSC 538P asked whether an attacker needs direct access to a memory database to exploit that trust boundary. The answer, in our experiments, was no: ordinary queries were enough to plant malicious associations that persisted across sessions and later changed agent behavior.
The security question
Traditional retrieval-augmented generation usually assumes a relatively static knowledge base. Agentic memory is different. It continuously decides what to write, how to represent it, what to retrieve, and how retrieved text should influence reasoning and tool use.
That lifecycle creates a persistent form of prompt injection:
- An attacker interacts through the normal query interface.
- The memory system decides that attacker-controlled content is worth storing.
- A later benign query retrieves that memory.
- The agent treats the retrieved content as context and may act on it.
We evaluated whether MINJA, a query-only memory injection attack, transfers to a production-oriented long-term memory stack.
What we tested
We implemented an EHRAgent workflow backed by mem0 and compared it with a simpler static RAG-style baseline. The attack used MINJA's Progressive Shortening Strategy, which gradually turns an explicit malicious association into shorter, more natural-looking interactions.
The evaluation covered three healthcare settings:
- MIMIC-III question answering, where poisoned memory directly supplied a false factual attribute.
- MIMIC-III identity swapping, where the association had to survive SQL generation and tool execution.
- eICU identity swapping, which also required the poisoned association to propagate through multi-step reasoning.
We tracked three metrics:
- Injection Success Rate (ISR): whether the malicious association was written to memory.
- Attack Success Rate (ASR): whether later outputs exhibited the attacker-intended behavior.
- Utility Degradation (UD): the relative accuracy change on benign queries after poisoning.
Results
| Setting | ISR | ASR | Utility degradation |
|---|---|---|---|
| mem0 · MIMIC-III Q&A | 100% | 99.12% | 0.0% |
| mem0 · MIMIC-III identity swap | 100% | 33.33% | -16.7% |
| mem0 · eICU identity swap | 83.33% | 80.00% | -13.3% |
| Static RAG · MIMIC-III | 95.6% | 57.0% | -0.7% |
| Static RAG · eICU | 98.5% | 90.0% | 0.0% |
The near-perfect Q&A result is the clearest warning. Poisoned memory could directly replace the answer, bypassing the agent's normal reasoning path while leaving unrelated-query accuracy unchanged. A system monitoring only broad utility would have little evidence that anything was wrong.
What the results mean
The write stage is the primary failure point
mem0 stored the malicious association in every MIMIC-III trial and in 83.33% of eICU trials. Its write policy was optimized to retain useful information, not to establish the provenance or intent of that information.
Retrieval is not the same as control
High injection success did not always become high attack success. When poisoned memory had to influence SQL construction and survive tool execution, the attack frequently produced malformed calls or other failures instead of the attacker's intended result.
This is only partial protection. It depends on task structure and disappears when retrieved memory can directly supply an answer.
Model alignment does not secure external memory
The model's conversational safeguards did not extend to the memory store. Once attacker-controlled content was accepted as memory and reintroduced as trusted context, the system lacked a strong boundary between remembered information and instruction.
Defensive implications
Our experiments point toward controls at the memory boundary:
- Screen writes for instructional language, contradictions, and suspicious repeated associations.
- Preserve provenance so the agent can distinguish user claims, verified facts, summaries, and system-authored records.
- Isolate memory across users and security domains.
- Rate-limit and monitor repeated write attempts.
- Treat retrieved memory as untrusted data that must be validated before it can influence tools or high-impact decisions.
These are design implications rather than evaluated defenses. Measuring their effectiveness is an important next step.
Scope and limitations
The current evaluation focuses on mem0, MIMIC-III, and eICU. We did not complete planned tests of other memory architectures or the WebShop and MMLU settings. Results may also depend on model behavior, prompt configuration, and the safeguards of the selected model.
The work was conducted in a controlled research environment. We did not attack production systems or real users, and the experiments were limited to the minimum capability needed to measure the vulnerability.
Why this matters
Persistent memory is becoming a foundational component of agentic systems. If it is treated as a convenience layer rather than a security boundary, an attacker may be able to convert ordinary interaction into durable influence.
The central lesson is simple: an aligned model operating over untrusted memory is not an aligned system.
This project is a collaboration with Zhejun Jiang and William Cheng advised by Thomas Pasquier.
The project was conducted in UBC CPSC 538P.