AI agent memory is evidence, not authority

The four Jack drafts behind this guide found the same shape from four directions. A summarizer removes the hostile words of an untrusted note and keeps its conclusion. A consolidation writer turns “reportedly approved” into “approved.” A spawned subagent inherits an expired parent state and reports zero exceptions. A thumbnail keeps a hidden trigger after the source image is gone. In every case the system upgraded trust by losing information.

The 30 patterns shipped with this guide extend that finding across the whole memory lifecycle. They cover admission into memory, binding to an identity and tenant, replay of stale authority, laundering of confidence and coverage and leakage of private data through retrieval and serving. Each one names a concrete record shape. Each one fired on its own attack fixture and stayed silent on its benign twin before it reached the product. How Sunglasses sits in the pipeline explains where that check runs.

Link Origin Cache Admission. A malicious or redirected website link bypasses origin validation, enters a trusted retrieval cache under the wrong provenance and is later reused as agent memory or RAG context.

Resolver Parser State Corruption Retrieval Reuse. A malformed LLMNR/DNS query or resolver record can cross into retrieval backed agent memory as an apparently trusted answer, suppressing provenance checks and redirecting a later tool action.

Unsigned Artifact Authenticity Gap At Memory Admission. A memory/RAG ingestion path admits an offering image or artifact with an absent or invalid signature as trusted current evidence, allowing tampered content to influence a later agent decision.

Counterfactual Knowledge Conflict Memory Binding. Mutually inconsistent fictitious replacement facts for the same subject are fed through unlearning evidence. A downstream memory or retrieval consumer resolves the conflict by recency/last write and persists a false replacement as trusted knowledge.

Retrieval Provenance Decay Authority Laundering. A black box meaning preserving paraphrase can spoof the watermark distribution and a provenance consumer can mistake the counterfeit signal for trusted authorship evidence.

Identity Profile Active Session Binding Confusion. A retrieved victim identity profile is accepted for the current agent session without jointly binding person, tenant, principal, session and provenance, so downstream account, phishing, recipient or approval actions inherit the wrong identity context.

Fastgpt Split Request Trace Tenant Scope Projection. A valid authenticated session and known requestId are correlated with a foreign team FastGPT trace across separate request/response records, projecting prompts, retrieved RAG context or completions into the agent context without tenant binding.

Agent Mediated Cross Origin Memory Bridge. An agentic browser bypasses script level SOP indirectly by extracting data on origin A, writing it to origin unbound agent memory and reusing it as trusted context in a later origin B workflow.

Failed Auth Fallback Laundering. A fabricated Authorization value drives a failed key path into OAuth passthrough, where an empty auth object is accepted as caller identity and protected MCP memory/tool access is allowed.

Empty Analysis Fail Open Authorization. A SQL policy gate treats an empty dependency/reference set from a specialized query as proof that no restricted dataset is used, then admits excluded schema or federated data through an MCP database tool.

Memory Writeback Provenance Rebinding. A command specific memory entry approved for one target/epoch is replayed after the live task changes, so stale authorization reaches a consequential dispatcher action.

Memory Backed Tool Capability Projection. An attacker controlled retrieved memory record is mistaken for current authorization and projects a user inaccessible connected tool capability into the agent's action scope.

Long Horizon Dormant Activation Predicate Persistence. An attacker plants a dormant activation predicate in persistent memory. After many benign sessions, a later sensitive topic match wakes it and forwards private data.

Containment Proof Action Universe Staleness. A stale containment proof can claim a universal guarantee over an older typed action universe while a newly reachable action is omitted. The agent treats that unmodeled action as contained and dispatches it.

Structured Context Salience Ratchet. A multi round adaptive interaction makes a defender reuse structured graph risk context as a salience shortcut, producing asymmetric early refusal or an escalation blind spot instead of a fresh per turn safety decision.

Layer Paradigm Coverage Laundering. A browser security dashboard converts a clean result from some AI agent layers into an overall approval while an agent behavior or model layer is unknown, omitted or untested.

Aggregate Stability Masking. A high composite stability score under entropy stress masks one omitted high impact memory subdecision and an agent promotes the aggregate to a per decision safety guarantee.

Dp Assumption Witness Omission Fail Open. A verifier accepts a differential privacy guarantee after the adjacency, sampling or composition witness needed for that guarantee is omitted or mismatched.

Cascade Decision Coupling Retrieval Confidence Laundering. An attacker shaped retrieved suffix can make a lightweight cascade front end emit a benign looking confidence or complexity signal, causing the router to skip escalation or downgrade to a cheaper tier while the retrieved evidence remains untrusted.

Delegation Bridge State Laundering. A fine tuned cybersecurity QA model retains strong retrieval contextualization while vocabulary recognition and parametric knowledge degrade. A downstream model selection route masks the degraded axes and persists the model as trusted.

Trajectory Adaptive Decoy Memory Completion Laundering. A memory/RAG completion record stores a trajectory adaptive decoy's coherent observations and is retrieved as proof of real target penetration completion although the real target was never reached.

Browser Telemetry Provenance Spoofing. A generated survey answer is paired with replayed human like keystroke telemetry and the evaluator launders the correlated trace into independent proof of human authorship before storing the decision in memory/RAG.

Host Log Evidence Boundary Contamination. Noisy host telemetry can carry a control plane looking instruction that an LLM HIDS evaluator mistakes for policy, suppressing the surrounding detection event.

Quiz Mediated Membership Disclosure. A model facing RAG/evaluation workflow turns a target example into repeated multiple choice probes and leaks training membership evidence through indirect answer and confidence signals.

Paired Subset Differential Memory Attribution Probe. A paired subset memory evaluation differs two otherwise equivalent runs by one private item, then launders the resulting delta into client attribution or private memory membership evidence for the next agent decision.

Minimal Pii Cross Context Profile Reconstruction. An agent joins a minimal PII seed with public and contextual evidence across sources or task memory, infers sensitive attributes and emits a high fidelity personal profile without explicit per attribute request or consent.

Training Data Memorization Reproduction. A model generated clinical augmentation output reproduces a memorized private training record verbatim and a downstream agent accepts it as fresh synthetic evidence rather than detecting privacy leakage.

Dual Sided Split Representation Inversion. A split model boundary observer can invert the same intermediate representation stream to recover both a private user prompt and the model's generated response, while one sided defenses falsely imply privacy.

Shared Kv Cache Integrity Corruption Selective Persistence. A targeted bit flip in one physically shared BF16 prefix cache block can silently and persistently alter only the requests that reuse that prefix.

Mcp Descriptor Capability Hint Spoofing. A browser reachable MCP Inspector proxy turns DNS rebound local reachability plus missing client authentication into an MCP stdio process launch whose output can enter the agent evidence path.

Preserve source lineage. Keep the identity and trust state of the original record attached to every derived summary, embedding, caption or consolidation.

Preserve confidence as structured state. Do not let a rewrite flatten reportedly, unverified, tentative or low confidence into fact. Compare input and output confidence at every consolidation step.

Bind the record to its owner. Store person, tenant, principal, session, origin and policy version with the record. Reject a record whose tuple is incomplete or does not match the current task.

Check signatures and conflicts at admission. Unsigned artifacts, contradictory replacement facts and spoofed authorship signals stop at the door and are stored as quarantined, never as trusted.

Turn inheritance off by default. Pass a child agent the minimum context. Check expiry and policy version at spawn time. A prior validation label is not a current validation.

Separate correlation and coverage from authority. A joined trace, a dashboard score, a stability aggregate or a completion record can inform a decision. None of them can approve one.

Run counterfactual checks. Compare the proposed action with and without the memory record. If the decision changes and the record has no trustworthy lineage, stop.

Treat retrieval traffic as a channel. Watch for repeated probes, paired subset comparisons and verbatim reproduction of stored records.

Decide at the sink. Run current policy immediately before export, send, execute, install, approve or dispatch. Memory never substitutes for that check. The Sunglasses manual covers where to place that check.

Fail closed. Missing lineage, missing expiry, missing witness or a changed target stops the action and creates a review record.

The four source drafts each recorded a candidate detector that separated six hostile fixtures from eight benign controls in its own July corpus. Those four mechanisms, semantic taint laundering across sessions, memory confidence register upgrade, stale subagent state inheritance and multimodal transform provenance collapse, are not among the 30 patterns shipped with this guide. They remain research findings. This page claims coverage only for the 30 IDs listed in its ship metadata.

https://arxiv.org/abs/2604.23374v1. Information flow tracking for agents must survive semantic transformation and persistence through memory.

https://arxiv.org/abs/2606.29279v1. Uncertainty can disappear during consolidation while the claim gains authority.

https://atlas.mitre.org/. Adversarial threat landscape for AI systems, including poisoned tools and data.

https://sunglasses.dev/blog/agent workflow evidence contracts. The Sunglasses guide to binding protected actions to named evidence.

https://sunglasses.dev/blog/indirect prompt injection runtime trust. How hostile content hides in tools, metadata and retrieved documents.