Search papers, labs, and topics across Lattice.
This paper introduces MemSecBench, a comprehensive benchmark designed to evaluate the lifecycle security of agent memory systems against memory poisoning attacks. The study reveals that malicious memory persists in 84.2% of cases across various configurations, with a notable 50.3% success rate for the full Write鈥揈xecute chain, highlighting significant vulnerabilities in memory systems. Additionally, the findings demonstrate that different memory system stacks exhibit substantial variations in their ability to propagate malicious content and perform selective repair, with up to a 41.3 percentage point difference in repair success rates.
Malicious memory persists in 84.2% of tested cases, revealing critical vulnerabilities in agent memory systems that could shape real-world actions long after an attack.
Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons. To address this gap, we introduce MemSecBench, a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write--Execute--Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints. The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Across all 24 configurations, malicious memory persists in 84.2% of all cases, and the full Write--Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.Compared with matched Native configurations, the largest absolute differences are 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair. These descriptive contrasts indicate that the evaluated memory system stacks differ in lifecycle security, both in the propagation of malicious memory and in selective repair after successful memory poisoning.
