Unbounded memory displaces safety constraints

ID

unbounded-memory-displaces-safety-constraints

Severity

high (catalogue Medium; platform severity model has no 'medium')

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

OWASP LLM

LLM04:2025 — Data and Model Poisoning

OWASP ASI

ASI06:2026 (secondary ASI01:2026)

Family

LLM04 — Data and Model Poisoning

Red-team vectors

Prompt Injection

Tags

ai_security

Description

An agent memory is configured with no bound — no max-token limit, no max-turns / window, no summarisation. Unbounded conversation memory lets an attacker feed enough filler to stuff the context window and push the system’s safety instructions out of it (context-window stuffing). A memory with any declared bound produces no finding.

Examples

memory = ConversationBufferMemory()          (1)
1 Unbounded buffer memory — flagged.

A windowed memory (ConversationBufferWindowMemory(k=10)), a token limit (max_token_limit=2000), or a summarising memory (ConversationSummaryMemory) produces no finding.

Mitigation / Fix

  • Bound the memory: use a windowed memory (k=…​), a max_token_limit, or a summarising memory.

  • Keep the system / safety instructions outside the growable memory region.