Poisoned AI Agent Memory Persists 84.2% of the Time

Poisoned memory in AI agents persists 84.2% of the time, per MemSecBench.

That's not inert data sitting in a database. The full write-to-execute chain, poisoned memory turning into an actual action the agent takes, completes 50.3% of the time, per the paper.

MemSecBench ran 310 test cases across 48 contexts, per the arXiv paper. The matrix covered 24 configurations: two agent harnesses, four memory backends, three LLM backends.

Selective repair, stripping just the bad memory without breaking the rest, worked only 56.1% of the time. That number moved by 41.3 points depending on which configuration ran it, more than double the 16.1-point spread in attack success.

The take

Vendors will keep selling memory backends on how hard they are to compromise. MemSecBench's numbers say the bigger difference between backends is how well they let you clean up after a breach, not whether one happens. Watch whether repair rate, not attack-resistance, becomes the number teams start asking vendors for.