Memory Poisoning Lab

Your agent remembered it. Should it have?

A local test range for agent memory poisoning: persistent memory as an attack surface. Feed an agent’s memory controlled untrusted writes, watch a planted memory change what the agent does, then try to stop it - and prove the repair worked.

Scope, plainly. Synthetic targets, a scripted deterministic agent. This repo demonstrates the mechanics of memory poisoning, defense and repair from published research, on real memory backends. It is not evidence about the safety of any real LLM, hosted memory service, or production system. Never point anything in here at a system you do not own.

Why this exists

Agent memory layers are shipping fast, and the attack classes against them are documented in research (see Sources). This repo is a small, local place to watch those attacks happen and test a fix. The first four scenarios are built from the published taxonomy; A5 extends the range to the ranking window itself, and A6 to a second decision the owner never wrote a policy for: