---
title: "MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.27080v1"
permalink: "https://feed.astralor.com/items/itm_35edba9d136778a467f9cbd6"
published: "2026-07-29T16:06:54.000Z"
score: 81
channel: "ai"
tags: ["LLM Agent","MemSecBench","Memory Poisoning","Agent Memory Security","Lifecycle Security"]
---

# MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

## AI commentary

> This paper is a must-read for anyone concerned with AI agent security. It's not just another benchmark; it's the first to quantify the full chain of memory poisoning—write, persist, execute, repair—under a unified framework. If you are building production-grade agent systems, this paper directly reveals the risk differences across memory backends and why selective repair can be much harder than expected.

## At a glance

MemSecBench is a task-grounded benchmark for the lifecycle security of agent memory systems, covering 310 cases drawn from 48 realistic contexts across code, science, daily life, and office work. Each case follows a controlled Write-Execute-Forget protocol in an isolated runtime. Experiments are conducted on a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Results show that malicious memory persists in 84.2% of all configurations, the full attack chain succeeds in 50.3%, and selective repair reaches 56.1% among successfully poisoned cases. Significant differences in lifecycle security are observed across memory system stacks.

## Key points

- MemSecBench contains 310 cases across code, science, daily life, and office scenarios.
- Experiments span 24 configurations: 2 agent harnesses × 4 memory backends × 3 LLM backends.
- Malicious memory persists in 84.2% of all configurations; full attack chain succeeds in 50.3%.
- Among successfully poisoned cases, selective repair rate is 56.1%, with large gaps between memory stacks (up to 16.1 pp for attack success, 41.3 pp for repair).

## Full text

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasingly examine agent memory security, yet few trace the same malicious semantics across persistence, downstream consequences, and selective repair under diverse memory-backend comparisons. To address this gap, we introduce MemSecBench, a task-grounded benchmark for the lifecycle security of agent memory systems. It contains 310 cases drawn from 48 realistic contexts across code and science, daily life, and office work. Each case follows a controlled Write--Execute--Forget protocol in an isolated runtime under an exact agent configuration, defined by an agent harness, a memory backend, and an LLM backend. Evidence-based adjudication combines a deterministic write check, checkpoint-specific judge-model evaluations, and programmatic gates across seven lifecycle checkpoints. The experimental design spans a 24-configuration matrix of two agent harnesses, four memory backends, and three LLM backends. Across all 24 configurations, malicious memory persists in 84.2% of all cases, and the full Write--Execute chain succeeds in 50.3%. Among successfully poisoned cases, 59.6% complete the full Execute chain, while 56.1% achieve selective repair.Compared with matched Native configurations, the largest absolute differences are 16.1 percentage points for end-to-end attack success and 41.3 percentage points for selective repair. These descriptive contrasts indicate that the evaluated memory system stacks differ in lifecycle security, both in the propagation of malicious memory and in selective repair after successful memory poisoning.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_35edba9d136778a467f9cbd6