[{"data":1,"prerenderedAt":660},["ShallowReactive",2],{"docs-page-en-/usecase/blog/memory_poisoning_controls":3,"surround-en-/usecase/blog/memory_poisoning_controls":648},{"id":4,"title":5,"avatar":6,"banner":6,"body":7,"category":6,"desc":6,"description":613,"extension":642,"lead":6,"links":6,"meta":643,"navigation":6,"path":644,"seo":645,"stem":646,"__hash__":647},"docs/en/usecase/blog/memory_poisoning_controls.md","Memory Poisoning: Six Long-Term Memory Controls Enterprise Agents Need",null,{"type":8,"value":9,"toc":612},"minimark",[10,21,24,27,35,38,41,46,49,52,71,74,77,79,83,172,175,177,181,186,189,192,194,198,201,204,206,210,213,216,218,222,225,228,230,234,237,240,242,246,249,252,254,258,261,264,372,375,377,381,384,415,418,421,423,427,430,433,436,439,441,445,448,451,454,474,477,479,483,486,489,492,494,498,530,532,536,540,543,545,549,552,554,558,561,563,567,570,572,576,579,581,585,588,591,594,597,599,603,606,609],[11,12,13],"blockquote",{},[14,15,16,20],"p",{},[17,18,19],"strong",{},"Key takeaway:"," Memory poisoning occurs when untrusted information enters persistent memory and is reused in future sessions, tasks, or across agents. Enterprises need lifecycle controls around provenance, writing, updates, isolation, retrieval, and deletion alongside output safeguards. MemOS provides system entry points for writing, retrieval, feedback, deletion, and orchestration, working with identity and permissions, input validation, approvals, monitoring, and security operations.",[22,23],"hr",{},[14,25,26],{},"With one-off Q&A, a wrong answer's effects usually end with the session. When agents have long-term memory across sessions, errors can be stored, recalled, and propagated through later tasks and other agents.",[14,28,29,30,34],{},"In August 2026, Forcepoint published ",[31,32,33],"em",{},"Agentic AI Security Risks: What CISOs Need to Know",". Drawing on X-Labs research, it discussed persistent risks from contaminated memory and context: false context, fabricated preferences, or incorrect behavioral patterns written into persistent state can affect subsequent decisions. In a multi-agent architecture, one agent's contaminated output can become another's input.",[14,36,37],{},"Compared with ordinary prompt injection, memory poisoning is harder to handle because its effects may appear later and survive the original session. A false memory can resurface weeks afterward as a fact the system supposedly already knows.",[39,40],"br",{},[42,43,45],"h2",{"id":44},"from-prompt-injection-to-memory-poisoning-what-changes","From prompt injection to memory poisoning: what changes?",[14,47,48],{},"Prompt injection typically attempts to alter behavior during the current interaction. A web page might contain hidden instructions that steer an agent away from its rules or toward inappropriate tool calls.",[14,50,51],{},"In a stateless system, the effect may end with the task. A persistent agent can write the resulting content into long-term state:",[53,54,55,59,62,65,68],"ul",{},[56,57,58],"li",{},"Save an attacker-supplied contact as a trusted supplier.",[56,60,61],{},"Summarize an abnormal operation as successful experience for reuse.",[56,63,64],{},"Mistake instructions on a malicious page for a lasting user preference.",[56,66,67],{},"Share contaminated task conclusions across agents.",[56,69,70],{},"Treat false information as historical evidence more trustworthy than external sources during future retrieval.",[14,72,73],{},"Long-term memory expands both agent capability and the time and scope over which an attack can persist.",[14,75,76],{},"Traditional controls are better suited to checking individual requests, connections, or tool calls. Memory poisoning requires observing information throughout ingestion, processing, storage, retrieval, feedback, and deletion.",[39,78],{},[42,80,82],{"id":81},"how-contaminated-information-becomes-a-lasting-risk","How contaminated information becomes a lasting risk",[84,85,86,102],"table",{},[87,88,89],"thead",{},[90,91,92,96,99],"tr",{},[93,94,95],"th",{},"Stage",[93,97,98],{},"What can happen",[93,100,101],{},"Controls to establish",[103,104,105,117,128,139,150,161],"tbody",{},[90,106,107,111,114],{},[108,109,110],"td",{},"Input",[108,112,113],{},"Web pages, emails, tool results, or external agents carry untrusted content",[108,115,116],{},"Label source, trust level, and data type; validate high-risk inputs",[90,118,119,122,125],{},[108,120,121],{},"Writing",[108,123,124],{},"A model summarizes temporary content or malicious instructions as lasting facts",[108,126,127],{},"Write permissions, policy validation, approval of sensitive operations",[90,129,130,133,136],{},[108,131,132],{},"Persistence",[108,134,135],{},"Incorrect information loses its context and becomes a stable memory",[108,137,138],{},"Preserve source, time, creator, version, and validity period",[90,140,141,144,147],{},[108,142,143],{},"Retrieval",[108,145,146],{},"Similarity search recalls a poisoned memory in the wrong situation",[108,148,149],{},"Identity and scope filters, freshness checks, reranking, confidence thresholds",[90,151,152,155,158],{},[108,153,154],{},"Action",[108,156,157],{},"An agent uses it to call tools, make recommendations, or change business state",[108,159,160],{},"Least privilege, confirmation of critical actions, output and tool-call monitoring",[90,162,163,166,169],{},[108,164,165],{},"Propagation",[108,167,168],{},"Results enter other agents, summaries, knowledge bases, or derived memories",[108,170,171],{},"Lineage, limits on cross-domain sharing, traceability, and bulk remediation",[14,173,174],{},"This chain gives security teams an acceptance criterion: can contaminated information be identified, blocked, traced, and removed?",[39,176],{},[42,178,180],{"id":179},"six-governance-questions-a-production-memory-system-must-answer","Six governance questions a production memory system must answer",[182,183,185],"h3",{"id":184},"_1-where-did-this-memory-come-from","1. Where did this memory come from?",[14,187,188],{},"Distinguish explicit user statements, business records, external documents, model inferences, and agent summaries.",[14,190,191],{},"When different sources are compressed into indistinguishable text, later systems struggle to judge reliability. Preserve provenance, creation time, creator, related task, and processing history for traceability.",[39,193],{},[182,195,197],{"id":196},"_2-who-can-write-and-modify-it","2. Who can write and modify it?",[14,199,200],{},"Reading and writing long-term memory need separate permissions.",[14,202,203],{},"Web pages, email, tool results, and third-party agents can all carry untrusted input. Define writing boundaries for users, organizations, applications, agents, and external sources, with validation or human confirmation for high-risk updates.",[39,205],{},[182,207,209],{"id":208},"_3-how-does-new-information-relate-to-old-memory","3. How does new information relate to old memory?",[14,211,212],{},"Long-term memory needs more than an append-only log.",[14,214,215],{},"When a new fact arrives, determine whether it supplements, corrects, replaces, or contradicts an earlier one. Simply retaining both can make an agent retrieve incompatible conclusions in the future.",[39,217],{},[182,219,221],{"id":220},"_4-how-are-different-subjects-isolated","4. How are different subjects isolated?",[14,223,224],{},"Multiple users, agents, and business systems generate many memories. Define personal, team, organization, task, and agent ownership, along with permitted sharing and access boundaries.",[14,226,227],{},"Isolation that relies on ad hoc parameter assembly becomes harder to maintain as systems grow, increasing unauthorized access and cross-scope leakage risks.",[39,229],{},[182,231,233],{"id":232},"_5-can-incorrect-memories-be-corrected-rolled-back-and-deleted","5. Can incorrect memories be corrected, rolled back, and deleted?",[14,235,236],{},"Finding an error is the first step. A system also needs to locate its copies and derived information and stop further use.",[14,238,239],{},"Feedback, versions, rollback, precise deletion, and forgetting are core controls for long-term memory.",[39,241],{},[182,243,245],{"id":244},"_6-can-the-system-keep-detecting-anomalies","6. Can the system keep detecting anomalies?",[14,247,248],{},"Memory poisoning can change behavior slowly and cumulatively. Reviewing individual answers may miss long-term drift.",[14,250,251],{},"Record memory writes, updates, retrievals, and deletions. Observe which memories an agent used, what data it accessed, which tools it called, and whether its behavior departed from the normal baseline.",[39,253],{},[42,255,257],{"id":256},"how-memos-places-memory-governance-in-the-architecture","How MemOS places memory governance in the architecture",[14,259,260],{},"MemTensor treats long-term memory as a system resource requiring independent management.",[14,262,263],{},"MemOS sits between agentic AI and large language models, separating memory writes, retrieval, feedback, deletion, and module orchestration from scattered application logic. Publicly documented capabilities and their security value include:",[84,265,266,282],{},[87,267,268],{},[90,269,270,273,276,279],{},[93,271,272],{},"Governance goal",[93,274,275],{},"MemOS capability",[93,277,278],{},"Contribution",[93,280,281],{},"Official reference",[103,283,284,303,320,337,354],{},[90,285,286,289,292,295],{},[108,287,288],{},"Make writes explicit",[108,290,291],{},"Add Message",[108,293,294],{},"Applications choose which messages enter memory processing",[108,296,297],{},[298,299,291],"a",{"href":300,"rel":301},"https://memos-docs.openmem.net/memos_cloud/mem_operations/add_message/",[302],"nofollow",[90,304,305,308,311,314],{},[108,306,307],{},"Constrain retrieval by query and scope",[108,309,310],{},"Search Memory",[108,312,313],{},"Applications retrieve as needed at a task stage",[108,315,316],{},[298,317,310],{"href":318,"rel":319},"https://memos-docs.openmem.net/memos_cloud/mem_operations/search_memory/",[302],[90,321,322,325,328,331],{},[108,323,324],{},"Provide a correction channel",[108,326,327],{},"Add Feedback",[108,329,330],{},"Sends inaccurate, changed, or unsuitable information back into the memory flow",[108,332,333],{},[298,334,327],{"href":335,"rel":336},"https://memos-docs.openmem.net/memos_cloud/mem_operations/add_feedback/",[302],[90,338,339,342,345,348],{},[108,340,341],{},"Provide a removal channel",[108,343,344],{},"Delete Memory",[108,346,347],{},"Explicitly removes incorrect, expired, or unwanted memories",[108,349,350],{},[298,351,344],{"href":352,"rel":353},"https://memos-docs.openmem.net/memos_cloud/mem_operations/delete_memory/",[302],[90,355,356,359,362,365],{},[108,357,358],{},"Organize memory modules",[108,360,361],{},"Open-source MOS",[108,363,364],{},"Orchestrates agents' access to different memory modules",[108,366,367],{},[298,368,371],{"href":369,"rel":370},"https://memos-docs.openmem.net/open_source/modules/mos/overview/",[302],"MOS architecture",[14,373,374],{},"These capabilities provide a governance foundation. They do not promise automatic immunity to memory poisoning, and an API alone does not establish that an enterprise control has been deployed. A complete flow also needs identity management, least privilege, input validation, human approvals, DLP, SIEM, business logs, and incident response.",[39,376],{},[42,378,380],{"id":379},"why-feedback-and-deletion-need-formal-apis","Why feedback and deletion need formal APIs",[14,382,383],{},"Prototypes often focus on adding and retrieving memories. Updates and deletion are equally important for security and governance.",[14,385,386,387,394,395,394,401,407,408,414],{},"MemOS provides ",[298,388,390],{"href":300,"rel":389},[302],[391,392,393],"code",{},"/add/message",", ",[298,396,398],{"href":318,"rel":397},[302],[391,399,400],{},"/search/memory",[298,402,404],{"href":335,"rel":403},[302],[391,405,406],{},"/add/feedback",", and ",[298,409,411],{"href":352,"rel":410},[302],[391,412,413],{},"/delete/memory",".",[14,416,417],{},"Feedback lets applications report that a memory is inaccurate, a preference has changed, or a result should no longer be reused. Deletion makes removal of incorrect, stale, or unsuitable information an explicit operation.",[14,419,420],{},"Enterprise applications connect these APIs to identity, permissions, auditing, and business approvals. Governance records should identify the actor, the basis for a change, affected objects, and completion status.",[39,422],{},[42,424,426],{"id":425},"layered-memory-brings-layered-risks","Layered memory brings layered risks",[14,428,429],{},"Plaintext, activation, and parameter memories have different visibility and modification costs.",[14,431,432],{},"Plaintext is easier to inspect, edit, and trace. Activation memory is closer to real-time inference. Parameter memory can carry stable learned capabilities. Incorrect information has different effects and remediation paths at each layer.",[14,434,435],{},"Governance therefore needs to check whether information has reached caches, graph relationships, derived summaries, skills, and other reusable state as well as the original stored text.",[14,437,438],{},"Layering also makes it possible to set different writing thresholds, update strategies, and audit methods for different memory forms.",[39,440],{},[42,442,444],{"id":443},"private-and-edge-deployments-still-need-governance","Private and edge deployments still need governance",[14,446,447],{},"Private or edge deployment can reduce the risk of data leaving organizational or device boundaries, but incorrect writes, excessive permissions, unclear provenance, and internal contamination remain concerns.",[14,449,450],{},"An incorrect local memory remains incorrect, and excessive privileges in a private environment can still permit unauthorized access.",[14,452,453],{},"Production governance needs to consider:",[53,455,456,459,462,465,468,471],{},[56,457,458],{},"Where data resides.",[56,460,461],{},"Who can read, write, modify, and delete it.",[56,463,464],{},"How external information is validated before ingestion.",[56,466,467],{},"How sources and versions are recorded.",[56,469,470],{},"How anomalous calls are detected.",[56,472,473],{},"How users and administrators correct system state.",[14,475,476],{},"MemOS supports cloud, private, edge, and edge–cloud deployment approaches. Deployment addresses data boundaries, performance, and operations; memory governance applies across them.",[39,478],{},[42,480,482],{"id":481},"different-industries-need-different-memory-risk-models","Different industries need different memory risk models",[14,484,485],{},"AI companions emphasize persona consistency, user control, and sensitive preferences. Smart hardware needs user isolation and local privacy. Financial agents emphasize policy freshness, business permissions, and auditing. Industrial agents need to distinguish equipment facts, expert experience, and field anomalies.",[14,487,488],{},"Treating all information as the same kind of searchable text hides these differences.",[14,490,491],{},"Define by industry and task what can be written automatically and what requires confirmation; what may be shared and what stays isolated; what can remain indefinitely and what expires; and what errors can be corrected through feedback versus requiring immediate suspension and audit.",[39,493],{},[42,495,497],{"id":496},"a-pre-launch-enterprise-checklist","A pre-launch enterprise checklist",[53,499,500,503,506,509,512,515,518,521,524,527],{},[56,501,502],{},"Record source, creator, time, scope, and validity period for each memory.",[56,504,505],{},"Distinguish read, write, update, delete, and cross-subject sharing permissions.",[56,507,508],{},"Treat external pages, emails, and tool outputs as untrusted input by default.",[56,510,511],{},"Require confirmation for high-risk memory writes and critical business actions.",[56,513,514],{},"Define overwrite, retention, downranking, or review rules for conflicts.",[56,516,517],{},"Trace which tasks recalled a memory and which actions it affected.",[56,519,520],{},"Support suspending use, correcting or deleting the source, and tracing derived state after contamination.",[56,522,523],{},"Monitor write volume, retrieval hits, conflicts, feedback corrections, deletion completion, cross-domain access, and anomalous tool calls.",[56,525,526],{},"Regularly test prompt injection, cross-tenant leakage, stale memories, and propagation with red-team samples.",[56,528,529],{},"Define responsibility boundaries for cloud, private, and edge deployments.",[39,531],{},[42,533,535],{"id":534},"frequently-asked-questions","Frequently asked questions",[182,537,539],{"id":538},"what-is-memory-poisoning","What is memory poisoning?",[14,541,542],{},"It is the risk that untrusted or incorrect information enters an agent's persistent memory and influences decisions or actions in future tasks. Persistence is the defining feature: effects can survive across sessions and propagate to derived memories or other agents.",[39,544],{},[182,546,548],{"id":547},"how-does-it-differ-from-prompt-injection","How does it differ from prompt injection?",[14,550,551],{},"Prompt injection typically manipulates the current interaction. Memory poisoning concerns malicious influence written into long-term state. Injection can be an entry point; persistence and future reuse create the lasting memory-layer risk.",[39,553],{},[182,555,557],{"id":556},"is-private-deployment-enough-to-make-it-safe","Is private deployment enough to make it safe?",[14,559,560],{},"Private deployment changes data and system boundaries. It still needs identity and permissions, input validation, auditing, monitoring, correction, and deletion to address incorrect writes, unauthorized access, fabricated provenance, and internal contamination.",[39,562],{},[182,564,566],{"id":565},"what-should-production-memory-telemetry-record","What should production memory telemetry record?",[14,568,569],{},"Alongside latency, errors, and cost, record write sources, scope, retrieval history, conflicts and overwrites, corrections, deletion status, permission denials, cross-domain access, anomalous tool calls, and links between memories and final decisions. Security investigations need to know which memory influenced which action.",[39,571],{},[182,573,575],{"id":574},"what-role-does-memos-play","What role does MemOS play?",[14,577,578],{},"MemOS makes writes, retrieval, feedback, deletion, and orchestration callable system capabilities, providing a memory-layer foundation for governance. It works alongside enterprise IAM, DLP, SIEM, approvals, and security operations; it does not automatically block every poisoning attack.",[39,580],{},[42,582,584],{"id":583},"agents-that-act-over-time-need-accountability-for-memory","Agents that act over time need accountability for memory",[14,586,587],{},"Continuity enables agents to retain history, continue tasks, understand users, and reuse experience. It can also let errors and attacks persist.",[14,589,590],{},"The next stage will evaluate whether systems can explain memory origins, update information correctly, keep untrusted content out of persistent state, give users and enterprises control, and trace, correct, and delete errors.",[14,592,593],{},"MemTensor's long-term intelligence roadmap spans Memory³ research, MemOS, agent and memory infrastructure, and memory-native models. Its central judgment is that memory improves personalization and constitutes infrastructure that needs governance in real production environments.",[14,595,596],{},"Long-running agents need a control system for the full memory lifecycle alongside a place to store history.",[39,598],{},[42,600,602],{"id":601},"about-memtensor","About MemTensor",[14,604,605],{},"MemTensor (Shanghai) Technology Co., Ltd. is a next-generation large-model and long-term intelligence infrastructure company incubated by the Shanghai Institute for Algorithms Innovation, with a member of the Chinese Academy of Sciences serving as chief advisor.",[14,607,608],{},"Focused on reducing hallucinations, personalization, and self-learning and evolution, the company studies long-term memory and continual learning for large models. Its roadmap connects Memory³ research, the MemOS memory operating system, agent and memory infrastructure products, and exploration of memory-native general-purpose foundation models, progressing from theory to systems engineering and model research to advance AI beyond one-off generation toward long-term intelligence.",[14,610,611],{},"MemTensor has established close collaborations with partners including China Merchants, Haicheng, and HONOR, and commercial deployments in AI companionship, games, smart devices, finance, and industry. It has raised nearly RMB 200 million in total, with investors including CICC, Futeng Capital, Hubble, SenseTime, and MSA Capital.",{"title":613,"searchDepth":614,"depth":614,"links":615},"",2,[616,617,618,627,628,629,630,631,632,633,640,641],{"id":44,"depth":614,"text":45},{"id":81,"depth":614,"text":82},{"id":179,"depth":614,"text":180,"children":619},[620,622,623,624,625,626],{"id":184,"depth":621,"text":185},3,{"id":196,"depth":621,"text":197},{"id":208,"depth":621,"text":209},{"id":220,"depth":621,"text":221},{"id":232,"depth":621,"text":233},{"id":244,"depth":621,"text":245},{"id":256,"depth":614,"text":257},{"id":379,"depth":614,"text":380},{"id":425,"depth":614,"text":426},{"id":443,"depth":614,"text":444},{"id":481,"depth":614,"text":482},{"id":496,"depth":614,"text":497},{"id":534,"depth":614,"text":535,"children":634},[635,636,637,638,639],{"id":538,"depth":621,"text":539},{"id":547,"depth":621,"text":548},{"id":556,"depth":621,"text":557},{"id":565,"depth":621,"text":566},{"id":574,"depth":621,"text":575},{"id":583,"depth":614,"text":584},{"id":601,"depth":614,"text":602},"md",{},"/en/usecase/blog/memory_poisoning_controls",{"title":5,"description":613},"en/usecase/blog/memory_poisoning_controls","UPDLbx_Spvd3537oUPiSDYKNY17zBx48MDpVBi19wJ8",[649,655],{"title":650,"path":651,"stem":652,"framework":6,"module":6,"class":653,"target":-1,"active":654,"defaultOpen":654,"children":-1,"description":-1},"ChatGPT Upgrades Background Memory Synthesis: Why Enterprise Agents Need Independent Long-Term Memory Infrastructure","/usecase/blog/chatgpt_dreaming_long_term_memory","usecase/blog/chatgpt_dreaming_long_term_memory",[],false,{"title":656,"path":657,"stem":658,"framework":6,"module":6,"class":659,"target":-1,"active":654,"defaultOpen":654,"children":-1,"description":-1},"Memory Management for Long-Running Agents: From Session Recovery to Reusable Experience","/usecase/blog/long_task_agent_memory_management","usecase/blog/long_task_agent_memory_management",[],1793163799830]