The memory layer is the attack surface

It is worth being direct about something. OWASP's guidance on Memory and Context Poisoning (ASI06) describes a class of attack where an adversary corrupts the information an agent stores and reuses across sessions. The attack surface is persistent memory: conversation summaries, long-term knowledge entries, retrieved facts from shared stores. Once poisoned data enters memory and is treated as trusted knowledge, it can redirect an agent's decisions, tool use, and risk assessments across every future session that draws on it.

That is a description of Recordari's core function.

We are not going to paper over that. A shared, persistent memory graph is exactly what ASI06 targets, and any honest account of what Recordari is has to acknowledge it. What we can say — and what the rest of this post is about — is that the architecture of the attack surface is also the architecture of the defense, and that a memory system built without these mitigations is a worse target, not a safer one.

How the attack actually works

The OWASP scenario is instructive. An attacker repeatedly claims, across several ordinary-looking conversations, that a flight route has a corporate price of $199 when the real price is $550. The assistant pushes back each time. But the system is designed to summarize conversations and write compact entries to long-term memory. Those summaries strip uncertainty and attribution. "A user claimed $199 is the corporate rate" becomes "$199 is the corporate rate." The summarized form gets retrieved in future sessions and treated as a settled fact.

The attacker never needed to break authentication, inject code, or escalate privileges. They only needed to influence what the system remembers. Then they waited.

What makes this particularly difficult to detect is the trust inversion built into summarization. Raw conversation logs are treated as lower-fidelity input. Summaries are treated as distilled, reliable knowledge — shorter, reused more frequently, higher in the retrieval stack. An attacker who can shape what gets summarized has discovered a trust escalation mechanism that the system itself provides.

Security researcher Johann Rehberger demonstrated exactly this pattern against Google Gemini's long-term memory feature in early 2025. Indirect prompt injection caused the model to retain false "facts" across entirely different future sessions, influencing responses to unrelated users. The attack was stealthy because it didn't bypass a content filter — it exploited the trust the system placed in its own persistent storage.

Three propagation vectors, three structural responses

The OWASP analysis identifies three ways a poisoned memory entry spreads: across sessions (persistence), across users (shared stores), and across agents (shared indexes). Recordari addresses each one structurally.

Cross-session persistence is the core propagation mechanism. A poisoned entry written today influences every session that retrieves it tomorrow. Recordari's audit log records every write with full attribution — which agent or user called remember(), with what arguments, at what time. After a poisoning incident, the question "which entries were written in this window by this source?" has a concrete, queryable answer. Without that record, remediation is guesswork.

Cross-user contamination — one attacker's input influencing other users — is contained by workspace isolation. Every node is scoped to a workspace; RLS enforcement means a remember() call cannot write across tenant boundaries and an orient() call cannot retrieve across them. The attack scenario where poisoned memory bleeds from one customer account into another customer's sessions cannot happen within Recordari's data model.

Cross-agent propagation — one agent's poisoned output becoming trusted input for another — is where standing nodes provide the critical anchor. A standing node is a high-authority, human-authored constraint: an architectural rule, a pricing policy, a security decision. Every orient() response returns standing nodes first, regardless of recency or retrieval score. When a poisoned agent tries to establish a false belief in the workspace, that belief has to coexist with standing nodes that were explicitly filed by a human. If the poisoned content contradicts a standing node, the contradiction is visible in the graph rather than silently overriding it.

What provenance tracking adds

The OWASP mitigation list emphasises provenance metadata: every memory entry should carry information about who wrote it, from what source, with what confidence, via what ingestion path. This is how you answer "where did this belief come from?" after an incident.

Recordari's owner stamping — owner_id and owner_type on every node — is the foundation of this. A node filed by an autonomous agent running an unattended workflow carries a different trust baseline than a node filed by a human workspace owner. A node derived from a conversation summary carries a different baseline than one filed explicitly and deliberately. These provenance signals feed directly into the trust score computation: topology (node kind and connected node kinds) gives one dimension; provenance gives a second.

The summarization attack specifically is addressed by requiring that agent-generated summaries inherit the trust level of their source rather than being promoted by the act of summarization. A summary of an unverified user claim is still an unverified claim. It should be stored with the attribution and trust level of what it summarizes, not elevated because it survived a compression step.

A signal already in the data

The repeated-reinforcement pattern — an attacker filing the same false claim across multiple sessions to build up apparent consensus — is detectable from Recordari's audit log without any additional instrumentation. An agent writing semantically similar nodes to the same domain at unusual frequency, from the same source identity, within a short time window, is behaving anomalously. That is a concrete signal: not "something looks wrong" but "this specific agent has filed N similar entries in domain Y in the last Z hours."

This is one of the signals the admin drift report is designed to surface. The passive signal (an active key gone silent — an agent that should be writing has stopped) and the active signal (an agent writing at abnormal frequency or repetition) together give a workspace owner a behavioral view of what their agents are actually doing in memory, rather than requiring post-incident forensics to reconstruct it.

What Recordari does not yet do

Write validation — scanning content before committing it to memory for malicious patterns or unsafe instructions — is not currently implemented. The OWASP guidance recommends this, and it is on the roadmap. Retention policies with automatic expiry for low-confidence entries are also not yet built. These are real gaps.

What exists today is the structural layer: the audit trail, workspace isolation, standing nodes as authoritative anchors, and owner stamping as the foundation for provenance-weighted trust. These do not prevent a sufficiently determined attacker from filing false content. They make the effects attributable, the propagation bounded, and the remediation possible.

The alternative — a memory system without audit attribution, without tenant isolation, without durable human-authored anchors — is not safer. It is the same attack surface, with less of the defense.

---

References: OWASP Agentic AI Threats and Mitigations — ASI06: Memory and Context Poisoning — Johann Rehberger, Embrace The Red (2025): Persistent Memory Poisoning via Indirect Prompt Injection — Triedman et al., Cornell Tech (2025)