SPORE Extracts 80% of an Agent's Private Long-Term Memory Through the Tool Interface, Defeating Per-User Memory Isolation

arXiv 2607.23444·high signalXBlueskyLinkedInCopy link

Production agent platforms mitigate memory-extraction risk by binding each user's long-term memory to a unique identifier, and this paper (arXiv 2607.23444) shows that defense is insufficient because agents routinely embed LTM-retrieved data in tool-call parameters, letting a malicious tool exfiltrate private memory without ever violating user-level isolation. SPORE decouples the adversarial command from retrieval anchors by persisting the command in short-term memory and emitting semantically pure anchors in tool responses, then runs a geometric coverage optimization over the embedding space to steer anchors toward unexplored memory regions. It achieves an 80.0% record extraction rate with unlimited triggers and 47.0% with only 20 triggers, and persists reactivation payloads that resume the attack across sessions without further user action. Directly relevant to anyone wiring mem0-style memory layers behind third-party tools.