MemoryDojo measures how a single untrusted tool output survives memory formation and changes subsequent tasks. Entry and authority. The attacker can change a tool result ingested into memory before later user tasks; no permission to directly edit the final memory store is assumed. Observed mechanism and consequence. The memory pipeline may retain…
Inspect the ClaimsCase · DiggingBeagle record
One poisoned tool result influenced future sessions through agent memory
MemoryDojo measures how a single untrusted tool output survives memory formation and changes subsequent tasks.
Public disclosure: Nov 6, 2026
Scope
The attacker can change a tool result ingested into memory before later user tasks; no permission to directly edit the final memory store is assumed. The memory pipeline may retain adversarial instructions after the original tool response disappears, affecting future independent tasks.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-MEMORYDOJO; reviewed as research in evaluation. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-MEMORYDOJO-01 · CLM-DB233-MEMORYDOJO-02 · CLM-ENR234-DB233-MEMORYDOJO · MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory
At a glance
Benchmark results vary by architecture and history length; they are not observed compromise rates in commercial deployments.
Limits and uncertaintyFull account
MemoryDojo measures how a single untrusted tool output survives memory formation and changes subsequent tasks.
Entry and authority. The attacker can change a tool result ingested into memory before later user tasks; no permission to directly edit the final memory store is assumed.
Observed mechanism and consequence. The memory pipeline may retain adversarial instructions after the original tool response disappears, affecting future independent tasks.
Limits and status. Benchmark results vary by architecture and history length; they are not observed compromise rates in commercial deployments.
MemoryDojo inserts a poisoned tool observation during one legitimate task and lets the agent's ordinary memory pipeline decide what to store. Later sessions may retrieve the original entry or copies created through subsequent memory writes. The authors distinguish insertion, retrieval, task-level behavioral reach and cumulative trajectory reach. Their results vary across A-MEM, Graphiti, Letta, Mem0 and Memora; no single benchmark percentage represents production memory compromise.
Mechanism and trust boundary
- 01
Precondition and trust context
The attacker can change a tool result ingested into memory before later user tasks; no permission to directly edit the final memory store is assumed.
- 02
Crossed boundary
The memory pipeline may retain adversarial instructions after the original tool response disappears, affecting future independent tasks.
- 03
Observed limit
Benchmark results vary by architecture and history length; they are not observed compromise rates in commercial deployments.
Timeline
- Nov 6, 2026Event type unspecified
Initial documented finding
One poisoned tool result influenced future sessions through agent memory
- Nov 6, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-MEMORYDOJO-01The benchmark contains 155 multi-session trajectories and 2,162 legitimate task sessions across workspace, travel, banking and Slack.supported
Basis: reported finding
- supportsMemoryDojo: Benchmarking Poisoning Through LLM Agent Memoryprimary disclosure
Introduction and Appendix A, benchmark composition
CLM-DB233-MEMORYDOJO-02The authors evaluated five memory implementations and distinguish per-task poison success from any-success across a trajectory.supported
Basis: reported finding
- supportsMemoryDojo: Benchmarking Poisoning Through LLM Agent Memoryprimary disclosure
Section 6 Evaluation and measures
CLM-ENR234-DB233-MEMORYDOJOFor Mem0 in the study's same-domain runs, optimized poisoning increased later-task behavioral reach from 7.90% to 21.02%; these percentages measure controlled trajectory tasks, not production incidents.supported
Basis: reported finding
- supportsMemoryDojo: Benchmarking Poisoning Through LLM Agent Memoryprimary disclosure
Section 6.2, Table 1: Mem0 BRT unoptimized versus optimized
Controls and mitigations
- Attach source identity and authorization context to every saved memory fact, and prevent tool-result instructions from being promoted into policy.
- Test memory deletion and derived-memory propagation over multiple later tasks, including runs with substantial benign conversation history.
Unknowns and contradictions
- Benchmark results vary by architecture and history length; they are not observed compromise rates in commercial deployments.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235