The attack surface memory creates
Agents keep memory so they can work across sessions. That is also what makes memory an attack surface: a malicious instruction encountered once can be written down, carried forward, and retrieved and acted on in a later session, long after whatever delivered it has gone.
MemoryDojo, described in a paper posted to arXiv on 6 November, is a benchmark built to trace that lifecycle rather than just to detect it. It follows poisoned information from the session where it enters, through the memory system’s processing and retrieval, to its influence on what the agent does next.
What it contains
The benchmark is 155 multi-session, long-horizon trajectories across four domains, and it supports five different memory systems. That second number is the point of the exercise. Memory architectures differ in how they decide what to store, how they summarise it and how they retrieve it, and those differences should change how far a poisoned instruction travels.
They do. The authors report that all five memory systems are susceptible to poisoning, with substantial variation in the downstream effects. Susceptibility is universal; severity is not.
Making the poison fit the architecture
The paper also proposes a memory-aware poison optimisation process, which tunes the injected content to the specific memory system it is aimed at and increases poisoning efficacy. That the optimisation works is itself a result: it means the differences between architectures are exploitable rather than merely incidental, and that an attacker who knows which memory system an agent runs has an advantage over one who does not.
Why it matters
Prompt injection is usually studied as a single-turn problem: untrusted text arrives, the model acts on it, the turn ends. Memory removes the ending. The window between a poisoned document being read and the instruction being acted on can span sessions, which breaks the assumption behind most runtime defences — that the dangerous input and the dangerous action are close enough together to be seen in the same trace.
It also complicates evaluation. A memory system that scores well on retrieval quality is not thereby safer, and the benchmark makes that separation measurable.
What to watch
The authors describe MemoryDojo as easily extensible, which is where its value will be decided: whether memory-system builders run it against their own designs, and whether anything in the current crop of architectures turns out to resist the optimised attack rather than merely attenuate it.
