Attackers hijacked agent memory with 100 percent success

AI agents that save external content to memory can lose its source, letting injected commands resurface as user history, per a new arXiv paper (2607.29167). That gap isn't rare. The paper found attacks exploiting it succeeded 100% of the time. One poisoned webpage or tool response became a standing command the agent later treated as trusted.

The failure happens during consolidation. When an agent folds a low-trust observation into long-term memory, the rewrite keeps the action trigger but drops the source tag. A scraped instruction reads back identically to something the user actually typed.

The paper's fix is a Provenance-Preserving Memory Firewall. It attaches platform-controlled provenance metadata to every memory. Before the agent acts, the firewall checks that metadata, weighing the action's risk against the authority of the memory backing it. The paper doesn't specify which agent frameworks it tested, just that the exploit worked in its own setup.

With the check in place, zero unauthorized high-risk actions got through, versus every single one succeeding without it.