The next AI agent breach lives in memory, not in the prompt

The attack surface for AI agents has moved below the conversation. As teams of language models start sharing a long-term memory to coordinate, the next quiet breach will not arrive in a prompt or a chat log. It will arrive as a memory write that looks ordinary, sits there, and then weaponizes itself the moment another agent retrieves it.

Existing agent defenses watch the wrong layer. They inspect prompts, output, and the message edges between agents, all of which still matter. What they do not see is the long-lived memory an agent reads and rewrites, the layer where one poisoned write can quietly steer many later decisions across agents that never saw the original attacker. The harm never crosses a visible communication edge, so perimeter tools stay silent.

MAPLE-Guard, a research preprint on arXiv, names the gap and proposes gates at four lifecycle points: write, retrieval, promotion, and cross-agent reuse. On LongMemEval, the paper reports the attack success rate fell from 38.2% to 0.9%; on AppWorld, from 34.7% to 0.2%. Defense success rose with it.

Treat it as a prototype, not a product. The numbers come from a single Qwen3.5-122B-A10B backbone, no peer review, and prompt-level and topology-level checks still have to run alongside. The category is settled: in this generation of agent stacks, memory is the trust boundary. Whoever keeps treating it as plain storage is the next incident.