Agent memory store without integrity

ID

agent-memory-store-without-integrity

Severity

high (catalogue Medium; platform severity model has no 'medium')

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM04:2025 — Data and Model Poisoning

OWASP ASI

ASI06:2026 (secondary ASI03:2026)

Family

LLM04 — Data and Model Poisoning

Red-team vectors

RAG Poisoning

Tags

ai_security

Description

An agent’s persistent memory is backed by a network-reachable store (Redis, Postgres, Mongo, …​) configured with no authentication or integrity controls. An attacker who can reach the backend tampers with the stored memory out-of-band, poisoning future sessions with no signal to the agent. A backend with authentication configured produces no finding.

Examples

saver = RedisSaver.from_conn_string("redis://cache:6379")   (1)
graph = builder.compile(checkpointer=saver)
1 Network-reachable memory store, no authentication — flagged.

Configuring authentication (and TLS) on the backend produces no finding.

Mitigation / Fix

  • Require authentication on the memory backend and enable TLS.

  • Add an integrity control (signed / checksummed entries) so out-of-band writes are detectable.