Loading today’s stories
Leadership1 distinct publisher3 min readPublished
Researchers at Shanghai Jiao Tong University and Ant Group report up to 76.6% attack success against an agent memory system without ever touching the store, which moves the problem from filtering inputs to trusting stored state.
The Board Room · Leadership desk
Compiled by The Board RoomSomething wrong?How this is made
The delivery mechanism here is the feature working as designed. Memory systems retrieve past records by relevance to the current query, and that is precisely what carries a planted record back into a later answer [9]. An attacker who names a target topic and a target output is therefore choosing which future questions will pull his record into context [4]. Topic selection, not payload cleverness, is the lever.
The reported numbers reward a careful reading. At the peak retrieval success rate of 35.4%, a single planting attempt fails roughly two times in three [6]. But the attacker in this model looks like an ordinary user with no access to the memory store, so nothing about the design caps him at one try [10]. Assuming independent attempts at that same rate, two interactions put the odds of at least one retrieval at about 58% (1 - 0.646^2) [14]. Rate limiting a single conversation does not bound that.
There is also a gap in the record worth naming. The paper reports attack success (76.6%) well above retrieval success (35.4%), and the account we have does not define either metric or say whether both were measured in the same configuration [15]. So we do not yet know whether the higher figure is conditional on retrieval or computed over a different denominator. Anyone putting 76.6% into a slide should say which, because the two readings imply different mitigations.
The skeptical position is already on the record and it is a fair one. Vibhum Dubey, a red teamer quoted by CSO Online, called the attack realistic but said he would not call every enterprise AI system immediately vulnerable, adding that the real problem is teams treating AI memory as application data rather than as security-sensitive state [11]. That is an answerable question inside your own architecture rather than a general claim about the field: does anything between the memory store and the generation step check what came back before it is trusted?
The board-deck version of this is "a new prompt injection variant, covered by our input filters." It is incomplete because the researchers looked at exactly those safeguards and noted they operate at interaction time, while injected content can appear benign when it is first introduced and only matter when retrieved [13]. Dubey's framing is the useful one: treat it as persistence, where the attacker plants once and waits for the agent to retrieve [12].
That leaves a trade-off nobody can filter their way out of. Longer retention is what makes an agent worth deploying, and it is also what enlarges both the write surface and the dwell time between planting and use [8]. Shorter retention shrinks the exposure and the product benefit together. There is no setting that gives you both.
This quarter the decision is narrow and mostly unglamorous: whether writes into agent memory carry provenance, and whether individual records can be found and removed. Next quarter's consequence follows directly from skipping it, because an incident review that asks why the agent gave a particular answer needs a write log to answer, and a system built on a store with no read or edit path for defenders will not have one [3].
Ranked by verification strength, evidence, and original report placement.
A newly demonstrated attack technique lets attackers plant hidden instructions inside an AI agent's memory with a single prompt, enabling them to influence how the system responds to future queries.
The technique, called InjecMEM, is described in a paper by researchers from Shanghai Jiao Tong University and Ant Group.
The paper describes InjecMEM as a "targeted red-teaming attack paradigm on agent memory systems with just one interaction and no read/edit access to the memory store."
The researchers wrote: "The attacker specifies a target topic and target output, aiming to make the agent generate that output for later queries on the topic."
The study evaluated the technique on a memory system called MemoryOS along with an agent framework, MemGPT, and tested it across several domains, showing how injected records can be retrieved and incorporated into subsequent responses.
The paper states: "On MemoryOS, InjecMEM substantially outperforms baseline attacks, achieving up to 35.4% retrieval success rate (RSR) and 76.6% attack success rate (ASR)."
Distinct publishers with included, body-backed reporting in this cluster.
Follow any of these and your For You feed starts watching them — no settings page required.
build
A refactoring benchmark stops the best agent at 41.2%, and the tests are the story1 distinct publisher
security
Fortinet Buys Virtue AI, and AI Red-Teaming Becomes a Suite Feature2 distinct publishers
build
Agent memory poisoning: 1.2% of the corpus, and both shipped defenses caught nothing1 distinct publisher
product
Alice raised $140m to red-team the frontier, and a security vendor bought in quietly1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One paper, quoted but never identified
CSO Online quotes the research accurately and at length, which is not the same as the research having been checked. The paper has no title, venue, or link anywhere in the coverage; both headline percentages are the authors' own, produced against two research memory stacks; and the higher of the two figures arrives with no definition and no stated configuration. Vibhum Dubey, the only outside voice, speaks to whether the scenario is plausible in enterprises, not to whether the numbers hold.
Lab bench only, nothing in the field
The single datapoint is the authors' run against MemoryOS and MemGPT. No production deployment, no affected vendor, no observed exploitation, no advisory, and no fix are described, so there is nothing to score without inventing it.
76.6% is doing work it hasn't earned
The headline number travels further than its own footing. Retrieval — getting the planted record pulled back into context at all — succeeded up to 35.4% of the time, and the 76.6% figure sits above it without any stated relationship between the two. CSO Online's framing of hackers planting hidden instructions is fair to the mechanism and generous to its reliability, and the story's most sober line, that not every enterprise system is immediately vulnerable, comes from the outside expert rather than the headline.
An attack paper from a company that sells the fix's neighbourhood
Ant Group is a co-author, and Ant Group builds the kind of agent infrastructure whose memory layer this paper reclassifies as a security boundary. The paper closes hoping its framework becomes a foundation for safer agent memory systems, which is a legitimate research aim and also a positioning statement. Add a security trade publication that reaches readers by naming new attack surfaces, and the whole chain rewards the same conclusion: memory is the next thing you have to defend. None of that makes the result wrong; it does mean nobody in the chain had a reason to test the numbers downward.
Confident about the mechanism, not the magnitude
What the mechanism is, and why it differs from prompt injection, is stated in the researchers' own words and is internally consistent — that part we can relay with reasonable comfort. How often it works, against what, and whether anything in production is exposed rests on one unverified document reported by one outlet, with the second-most-quoted person on the page arguing for restraint.