Your memory layer is your rogue agent tripwire

Security research on multi-agent systems keeps reaching the same uncomfortable conclusion. A team at Cornell recently demonstrated that common MAS frameworks — AutoGen, CrewAI, MetaGPT — can be coerced into executing arbitrary malicious code at success rates between 45% and 90%, depending on the configuration. In some setups the rate is 100%. The paper's title is not subtle: Multi-Agent Systems Execute Arbitrary Malicious Code.

What makes this finding genuinely unsettling is not the attack success rate. It's the reason for it. The paper's conclusion is that "multi-agent systems do not have a trust model, nor any semantics of inputs, actions." There is no infrastructure for distinguishing what an agent should believe from what it has been told. Every claim a sub-agent makes is treated as equally authoritative — including the false ones planted by an adversary.

This is a structural gap, not a bug in any particular framework. And it does not close by making individual agents more cautious. The Cornell team demonstrated attacks that succeed even when individual sub-agents are properly aligned and actively refuse to perform harmful actions. The system as a whole routes around the refusal.

The question classical security can't answer

The OWASP Agentic AI Threats and Mitigations guide frames rogue agent risk this way: classical security asks who is authorized to do this? Rogue agent risk asks a different question — is this agent still behaving as the thing we authorized? These are not the same question, and most security tooling answers only the first.

An agent can have valid credentials, call approved tools, and write to permitted destinations — while steadily doing the wrong thing. If it encountered a poisoned document that reframed its understanding of its own task, nothing in the permission system will notice. The agent is still authenticated. Its actions are still logged. The failure is behavioral.

This is exactly why detection has to happen at the persistence layer.

What agents carry forward is what matters

Stateless agents reset each session. A prompt-injected belief doesn't survive the conversation closing — but only if the agent never wrote it anywhere persistent. If it did, the reframed understanding becomes part of what every subsequent agent inherits when it picks up the project.

This is the threat that a memory layer either solves or amplifies, depending on how it's built.

Recordari's audit log records every read and write — who called what tool, with what arguments, and when. This is not just useful for compliance. It is the forensic record that makes behavioral analysis possible. After an incident, the question "what did this agent know, and who told it?" has a concrete answer. Without that record, the post-incident analysis cannot distinguish between drift, compromise, and design error. The OWASP guide is explicit on this point: forensic preservation at the time of containment is what makes a stop a learning event rather than just an outage.

Standing nodes as machine-checkable intent

The OWASP guide recommends agent manifests — machine-readable declarations of what an agent is supposed to do — as the primary control against behavioral drift. The intent is that the orchestration layer can reject actions that fall outside the declared scope, even if those actions are technically permitted.

Recordari's standing nodes serve this function at the knowledge layer. A standing node is a high-trust, durable rule or constraint — the kind of thing a human files deliberately: architectural decisions, project constraints, security policies. Every call to orient() returns standing nodes first, regardless of recency or connection count. They are always present in the agent's context.

When a compromised agent tries to reframe the project's goals, standing nodes provide a persistent reference point. The reframing has to contend with explicit, human-authored rules that are already in context. It cannot simply overwrite them — it would have to contradict them, and that contradiction is visible.

Two failure categories that should not exist

A research group at Tel Aviv University recently studied rogue agent behavior in collaborative multi-agent environments, monitoring agents for signs of imminent failure and intervening before errors could propagate. Their qualitative analysis found four categories of failure: hallucination (48%), collapse (16%), role loss (8%), and recall failure (4%).

Recall failure — an agent forgetting information that was previously shared in the session — is precisely what persistent memory eliminates for anything that was filed. If an agent filed a decision to Recordari, the next agent that orients on that domain finds it waiting. It is not re-derived, not re-explained, not forgotten.

Role loss — an agent losing track of what it is supposed to be doing — is what standing nodes address. The agent's declared role and constraints are in every orient() response. They do not fade with context window turnover.

Neither failure category should occur for agents working with a properly maintained memory graph. That is not a guarantee of safety. But it is a meaningful reduction in the surface area where things go wrong.

What Recordari does not do

It is worth being direct about the limits. Recordari does not prevent control-flow hijacking at the orchestration layer — the attack the Cornell paper describes happens before the memory layer is involved. It does not provide real-time monitoring of agent uncertainty during inference. It does not stop a compromised agent from acting on bad information in the moment.

What it does is make the effects of those failures visible, attributable, and recoverable. The audit trail shows what was read and written. The standing nodes show what the agent was supposed to know. The gap between the two is where the investigation starts.

That is not everything. But in a stack where everything else is stateless, it is more than most teams currently have.

---

References: OWASP Agentic AI Threats and Mitigations — Triedman et al., Cornell Tech (2025) — Barbi et al., Tel Aviv University (2025)