MemoryDojo tests how poisoned AI memories influence later tasks

When outside content becomes a remembered instruction

Memory helps AI agents carry facts, preferences and experience between sessions. It can also preserve instructions that never came from the user. An attacker-controlled document or tool response might be summarized as a preference, retrieved later and treated as guidance.

MemoryDojo, an arXiv preprint submitted on November 6, 2026, investigates this problem across five memory systems. David H. Yang and colleagues at Rensselaer Polytechnic Institute and Microsoft report that every evaluated system exhibited memory-poisoning vulnerabilities, although the frequency and persistence of harmful behavior varied substantially. These are preprint findings from controlled experiments, not a measurement of attacks against deployed services.

The paper illustrates the risk with an invoice assistant: a malicious email could falsely describe a forwarding address as a user preference. If that instruction enters memory, its influence could outlast the email’s presence in the assistant’s context.

Following one poisoned observation

The benchmark contains 155 multi-session trajectories covering workspace, travel, banking and Slack tasks. These comprise 93 same-domain sequences, 31 cross-domain sequences and 31 history-prefixed sequences that reuse the cross-domain tasks after adding recorded conversations. Task sequences range from three to 60 sessions; the history prefixes add 1,493 conversation sessions altogether.

At each task’s start, the agent retrieves memory into a fresh context window. After completing the task, it writes the interaction through the selected memory system’s native processing. Previously retrieved context is excluded from the write record to avoid automatically copying old memories into every new entry.

The attacker can append poison to one external tool observation. They cannot change system prompts, user requests, memory implementations or subsequent tool results. Ordinary tasks continue after that single insertion. Objectives include unauthorized tool actions and manipulating recommendations.

The researchers compare A-MEM’s linked notes, Graphiti’s entity–relation graph, Letta’s hierarchical memory, Mem0’s extracted facts and Memora’s linked semantic and episodic memory.

Storage, retrieval and obedience are different outcomes

MemoryDojo separates several stages that a single attack-success score could obscure. It checks whether poison survives the initial memory write, whether later retrieval exposes it, and whether the agent subsequently performs the attacker’s objective.

It also distinguishes persistence—retrieving the original poisoned entries—from propagation, where later writes create or contaminate other entries.

Two behavioral measures capture delayed effects. Behavioral reach is the fraction of evaluation runs with at least one successful attack after insertion. Task-level behavioral reach measures the fraction of subsequent tasks exhibiting the attacker’s objective, pooled across runs. Neither includes the insertion session itself.

In same-domain experiments with GPT-5.6-Luna and unoptimized payloads, later-task reach ranged from 7.76% for Graphiti to 21.02% for A-MEM. Four systems stored some recognizable representation of the poison in roughly 98–99% of runs; Mem0’s insertion rate was 60.75%.

Yet successful storage did not guarantee later exposure or compliance. Graphiti could retain a poisoned episode while returning relation facts that omitted its instruction. Across four systems, only about a quarter of poison-retrieving sessions produced the attacker’s desired behavior with unoptimized payloads.

Tailored attacks changed the results

The authors also developed memory-aware payload optimization. An LLM revised candidate attacks using descriptions of each memory system and feedback from separate synthetic environments. Selection sought greater later-task reach while imposing a legitimate-task completion threshold in those auxiliary tests.

Optimized payloads increased later-task reach for all five systems. Letta rose from 15.30% to 46.26%, a 30.96-percentage-point increase; A-MEM rose from 21.02% to 44.01%. Graphiti’s increase was smaller, from 7.76% to 9.31%.

The gains were not simply about retrieving poison more often: some systems became substantially more likely to follow it once retrieved. Tests with three additional models showed transfer, but changed the relative ordering of systems. Graphiti had the lowest optimized later-task reach across all four tested models, without being immune.

Longer histories weakened, but did not remove, the risk

Cross-domain experiments found attacker-desired behavior outside the targeted domain in four systems. Adding substantial benign conversation history reduced retrieval and later-task reach across every system, but four still showed delayed attack successes.

In the history-prefixed experiment, each of the 31 trajectories was evaluated separately under four domain objectives, yielding 124 trajectory–objective runs per memory system. Memora’s later-task reach was 5.32%, while 45.16% of those runs contained at least one later success. The latter figure is not the percentage of 31 distinct trajectories. Letta recorded no later successes in that setting—not evidence of universal protection. Legitimate-task completion was largely preserved in the history-prefixed tests, even where attacks succeeded; recall of benign history declined for some systems.

Important limits remain. The experiments used sandboxed tasks, synthetic trajectories and specific integrations with different native retrieval budgets. They compare complete configurations, not architecture in isolation. Memory-content classifications also rely on an LLM judge. The authors promise a future release of code and data, and leave systematic defense evaluation to future work. The practical contribution is a way to distinguish what malicious content is stored, what resurfaces and what actually changes behavior.