Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking

Abstract

Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measure the cost of this failure mode using plainly worded false assertions generated in a single pass, with no instruction, trigger, or retriever optimization. Poisoning 1.2% of a LongMemEval corpus reduces accuracy from 0.850 to 0.300. A four-stage write-time screening pipeline that reaches 0.832 recall on indirect prompt injection while flagging 1.5%

Categories

Framework mappings

Suggested from the entry's categories.

@misc{karunanidhi2026utility,
  title = {{Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking}},
  author = {Arulnidhi Karunanidhi},
  year = {2026},
  month = aug,
  eprint = {2608.21230},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.21230}
}