Topic
Confidentiality and integrity risks in persistent memory shared across LLM agent sessions, users and tenants.
Microsoft Security counted 50 memory poisoning attempts across 31 companies in 60 days, according to a security engineer's account of the report. The scanners most teams already run check inputs at arrival and never read the memory file.
Reality
Researchers at Shanghai Jiao Tong University and Ant Group report up to 76.6% attack success against an agent memory system without ever touching the store, which moves the problem from filtering inputs to trusting stored state.
Reality
A preprint write-up reports that plainly worded false memories cut accuracy from 0.850 to 0.300, and that screening plus provenance weighting rejected zero of 360 of them.
Reality
An Anthropic and EPFL preprint shows plain-language goals hopping agent to agent through persistent files, and a one-paragraph warning in the system prompt stopping nearly all of it.
Reality
A read-only sensor for cross-tenant memory leaks ships with no tagged release, because its own backend cannot enumerate what the retriever exposed. That limitation is the story.
Reality