AI agent memory needs current proof

Why stored truth becomes current permission

Memory systems fail when they preserve a useful conclusion and lose the conditions that made it valid. The record remains easy to retrieve. Its identity, evidence, scope and expiry become harder to see.

The AI agent memory security hub explains the broad rule. Memory is evidence, not authority. This sibling guide goes one level deeper. It examines the rest of the staged memory cluster. These 23 patterns focus on current proof. They show stale grants, escaped stores, fused fragments, misleading scores and skipped final checks.

A cached safety verdict is a clean example. The record may say that a prior request was safe. Retrieval may find that record because the new request looks similar. Similarity does not prove that the actor, target, policy or intent stayed the same. If the runtime skips a fresh decision, the old verdict becomes a portable permission token.

The same gap appears far outside a normal vector store. A restart can restore old local state. A benchmark can persist invented task requirements. A privacy evaluator can join metrics that use different denominators. A browser can receive active content through a URL that passed an incomplete scheme check. In each case a stored or derived signal survives longer than its proof.

When memory escapes its boundary

A memory boundary must control where state can be written, read and deleted. Three staged patterns show what happens when path or endpoint containment is missing.

GLS-MR-041 starts with resource containment. A valid model request can set an extreme best_of value. The serving layer generates many internal candidates before an admission limit or timeout can stop it. The request looks small at the edge and becomes expensive inside. Current proof here means calculating the real planned work before model service begins.

GLS-MR-042 covers an archive member name that escapes a memory staging directory during ZIP extraction. Parent segments or encoded dot segments can make a write land outside the intended root when the path is not normalized first. This pattern is tied to CVE-2026-59820 in LiteLLM Skills before version 1.83.7 stable. The safe order is normalize, resolve, confirm root containment and then write.

GLS-MR-043 moves the escape into meaning. An attacker poisons a structured knowledge graph. The query engine can then return a fabricated security fact through a trusted response shape. The agent may reason correctly from a false premise. A valid graph query proves that the store returned a fact. It does not prove that the fact is true.

These failures look different, but the contract is shared. A request does not define its own resource budget. An archive does not define its own write root. A graph does not certify its own truth. Local policy sets the boundary before stored material can influence work.

When separate records combine into harm

A record can be safe alone and dangerous in combination. Admission checks that inspect one item at a time cannot see the final effect.

GLS-MR-044 covers temporal fragment fusion. Several marker tagged writes each pass access control. A later request joins the hidden fragments into a restricted disclosure that never appeared in the final query. The system must inspect the assembled value and its destination. Passing each fragment does not approve their union.

GLS-MR-045 covers goal fusion during a browser task. A hostile page adds a secondary goal to active memory. The agent performs the new goal and then resumes the original task. The return to normal work hides the unauthorized transition. A task trace must show every goal change, its source and who approved it.

GLS-MR-046 covers a different kind of fusion. A negative or inconclusive falsifier result returns as positive confirmation. The concept then advances without the counterexample check it required. The result label, polarity and test identity must stay bound through serialization and retrieval.

GLS-MR-047 shows why a single safety signal is weak. A harmful prompt can be shaped to produce a benign looking expert routing footprint. A routing only auditor accepts the telemetry and misses the behavior. The pattern draws on RouteScan research. Routing can add evidence. It cannot replace inspection of the actual request and outcome.

GLS-MR-048 covers adversarial transfer across an intrusion classifier. An attacker changes only directly controllable network flow features and freezes the rest. A benign label crafted against a surrogate transfers across the classifier boundary. Current proof must include which features the attacker can control and whether the decision stays sound under that constraint.

GLS-MR-049 covers an embedding nearest neighbor collision. A TTP mapper selects a plausible but wrong technique, drops uncertainty and lets a later workflow treat the label as verified evidence. A nearest item is not a verified identity. Keep candidate rank and uncertainty visible until an independent check closes the finding.

When evaluators launder weak signals

An evaluator launders evidence when it converts a partial signal into a strong verdict without adding proof. Several staged patterns catch that conversion.

GLS-MR-051 covers a normal looking atomic rename or restore that makes stale hostile self state win at restart. The file operation is legitimate. The restored snapshot is not current unless the consumer checks its epoch and digest.

GLS-MR-053 covers a retrieved financial mandate replayed without current binding. A stale or planted mandate can reach a transfer sink with a changed beneficiary or amount. The pattern maps to the financial harm area in MITRE ATLAS. A payment record can explain a prior intent. Only a fresh approval bound to the current beneficiary, amount and actor can authorize a transfer.

GLS-MR-054 covers a self evolving agent that passes target fitness and a familiar regression suite, then loads a capability that fails an unseen safety invariant. Improvement on the target does not prove safety outside the measured suite. Hidden invariant holdouts and a controlled activation gate must stay outside the agent's own optimization loop.

GLS-MR-055 covers retrieval primitive placement laundering. A memory recipe makes a microarchitectural proof of concept look credible while a critical primitive is misplaced or missing. An agent can then produce an invalid or unsafe test from a polished record. The system must verify each required primitive and its position instead of trusting recipe shape.

GLS-MR-056 covers an MCP endpoint omitted from a reverse proxy auth gate. An unauthenticated remote caller reaches it, receives an internal session projection and performs an authenticated action. A session token minted inside the boundary cannot repair a missing check at the boundary. Every exposed route needs the same explicit auth policy.

GLS-MR-057 covers a privacy evaluator that combines similarity, uncertainty, adversary success and information loss from different scopes or denominators. The composite result looks coherent and falsely low. Every metric must carry dataset scope, denominator, calibration and run identity. A join must fail when those fields differ.

GLS-MR-058 covers fact check verdict propagation after provenance collapses. A stale or foreign evidence bundle produces a wrong verdict. The verdict then enters a publication record as current fact. Publication needs a fresh claim to evidence binding, source date and review result. A copied verdict is not copied proof.

GLS-MR-059 covers synthetic task reconstruction poisoning. A benchmark system invents a missing MPC task statement and persists attacker shaped requirements. A patch can pass those invented requirements while skipping cryptographic and numerical review. Reconstructed text must stay marked synthetic and cannot define the security acceptance test.

GLS-MR-060 covers a stale or broad Chroma match that upgrades a low confidence cloud IDS event. The match then bypasses model escalation or human review. A similar memory from another layer or calibration epoch cannot raise confidence until the current event is rebound and checked.

When revoked state returns

Deletion is not complete when one store forgets and another cache can restore the record. Revocation must move with the data.

GLS-MR-063 covers a shared prompt deletion path that uses an attacker controlled detail value without root containment. The path can reach an unrelated file through os.remove. This pattern is tied to CVE-2026-7404. A delete operation needs the same normalize, resolve and contain sequence as a write.

GLS-MR-064 covers an owner only operation reached by a low privilege requester. A remembered grant stands in for current permission while the final handler omits its own authorization check. The pattern is tied to CVE-2026-27055. Middleware can add a gate, but the protected operation still has to enforce its own actor and scope rules.

GLS-MR-065 covers sparse evidence operationalized as verified exploit proof. One retrieved playbook can look decisive when there is little independent evidence and no refutation. Sparse conditions should lower confidence and increase review. They should not turn the only available record into truth.

GLS-MR-066 covers semantic cache authority laundering after Forget or Rollback. A stale cache or another agent's replica resurrects a deleted record because the tombstone and deletion epoch did not travel with it. Every read must compare record epoch with deletion epoch. The deletion marker must win across replicas.

When the final operation skips its check

The last protected operation is where evidence becomes impact. It needs a fresh decision even when every earlier component reported success.

GLS-MR-072 covers active content that passes an incomplete URL scheme check. A validator removes javascript: but permits a script capable data:image/svg+xml value to reach an href or src sink. The browser then treats attacker supplied URL data as active content. A deny list for one scheme is not current proof. The sink needs a strict allow list based on the exact rendering context.

This final pattern exposes the broad lesson. Earlier layers can parse, rank, retrieve, summarize and validate correctly within narrow rules. The sink still owns the last decision. It knows the current actor, object, operation and consequence. That is where authorization, containment and format policy must become final.

Controls for current proof

Current proof is a small set of checks that every stored grant, verdict or derived signal must pass before it can affect a protected action.

Sunglasses is a content layer input filter for AI agents. The memory persistence poisoning pattern family shows the earlier generation of this work. These 23 patterns let it flag hostile record shapes when they appear in memory, retrieval results, logs and tool output. Runtime controls still have to carry identity, revocation and evidence through the workflow. A content filter can expose a dangerous claim. It cannot authorize a payment or prove that a deletion reached every replica.

Read the evidence with limits

Every pattern in this article passed the same staging gate. Its regular expression compiled. It fired on its own attack fixture. It stayed silent on its benign twin. It produced zero hits across a 78 document real repository corpus made from AGENTS.md, CLAUDE.md and README files from live public projects. Its ReDoS check finished under the three second budget.

That result is bounded. It shows separation for each saved hostile shape, its safe twin and one fixed benign corpus. It does not prove universal detection. It does not prove zero false positives on all documents. It does not prove that a regular expression can enforce revocation, operation level authorization or path containment. The CVP evaluations show how we measure the scanner against real model runs and the FAQ covers what a verdict means.

Implementation checklist

• List every store, cache, replica and restart snapshot that can restore agent state.
• Bind each record to actor, tenant, session, task, target, source and epoch.
• Carry tombstones and deletion epochs to every reader.
• Reject a restored record when its epoch or digest does not match current state.
• Preserve uncertainty, polarity, denominator and evidence links through every rewrite.
• Inspect combined fragments, goals and query plans before they take effect.
• Normalize and contain every archive, write and delete path.
• Set request wide work limits before model or retrieval scheduling.
• Keep synthetic tasks and inferred labels marked as unverified.
• Require matching scope and calibration before metrics are joined.
• Authenticate every exposed endpoint.
• Authorize every protected operation in its final handler.
• Use strict URL scheme and content rules at rendering sinks.
• Run current policy before transfer, publish, delete, execute or render.
• Test each hostile record beside its benign twin.

Sources