A new memory-layer attack plants instructions in AI agents with a single prompt

The memory layer of an AI agent, the part that stores past interactions and reuses them as context for new questions, is now a demonstrated attack surface, according to a new paper from researchers at Shanghai Jiao Tong University and Ant Group.

Their technique, dubbed InjecMEM, is a single-prompt injection aimed at the memory layer rather than the model itself. Where ordinary prompt injection alters a single reply, an InjecMEM seed gets written into the agent's memory store and resurfaces when the agent retrieves it on later, unrelated queries. The researchers say one entry point is enough to steer an agent across sessions, with no read or edit access to the memory store required.

On MemoryOS, an open memory-augmentation framework, the researchers report a 35.4% retrieval success rate and a 76.6% attack success rate, beating the baselines they compared against. The paper also tests the approach against MemGPT, a separate agent memory framework, and ships a reference implementation on GitHub.

InjecMEM is a red-team, or adversarial security testing, demonstration on research frameworks, not an observed attack on a deployed product. The practical lesson is the same one the paper makes explicit: treat the memory write path as untrusted input. Add provenance on what gets persisted, filter retrieved records before they reach the model, and keep humans in the loop for writes from untrusted users, not just for prompts.

The CSO Online writeup is putting the work in front of security teams this week.