The report
The attack in MemoryDojo was not a direct request to the agent in the next conversation. The attacker altered one tool response in an earlier task and relied on the system to preserve some of that response as memory. When the user later returned with a legitimate request, the agent retrieved that stored material and sometimes followed the injected instruction. The benchmark Case records 155 trajectories and 2,162 legitimate task sessions spanning workspace, banking, travel and Slack-like scenarios.
The persistence step is the vulnerability under test
The attacker did not receive arbitrary write access to the memory database. They controlled a lower-trust observation at a time when the agent was updating its knowledge of the user's environment. This distinguishes the experiment from the simpler case of writing a malicious system prompt or issuing an unauthorized direct command. The memory pipeline promoted information from a specific tool output into context that a later session considered relevant.
The researchers evaluated five systems: A-MEM, Graphiti, Letta, Mem0 and Memora. In the tested same-domain setting, optimized attacks raised the later-task success rate for Mem0 from 7.90% to 21.02% and for Letta from 15.30% to 46.26%. A separate any-success-across-a-trajectory metric is larger for some systems; the denominators differ and must not be presented as the same rate.
Ordinary memory use can hide a malicious instruction
The legitimate tasks were real tasks within the constructed evaluation, not deliberately malicious user prompts. A retrieved memory can be helpful for one part of an instruction while carrying an unauthorized directive for another. The evaluation also examined accumulated benign history, making it possible to separate immediate response poisoning from content that remains influential after many intervening messages.
Nothing in these measurements establishes that the named products have suffered real data theft through this precise method. They do establish a repeatable test: mark a stored fact with its original tool, principal and trust level; repeat later queries; then check both answers and external effects. Deleting the obvious original tool text may not be sufficient when derived summaries or memories have already been generated. The first-party paper documents the evaluation settings.