2 papers this week that fix agent memory poisoning & privacy leaks, but there's no library you can actually use.
Summary
Two papers published this week address agent memory poisoning and privacy leaks, but no readily usable library or tool has been released to implement these fixes.
Similar Articles
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
This paper introduces GhostWriter, a novel attack vector that exploits memory subsystems in LLM-powered personal agents to poison their memory store, achieving high injection and activation rates. The authors propose AM-Sentry, a defense that significantly reduces attack success while maintaining agent utility.
MemPrivacy: Privacy-Preserving Personalized Memory Management for Edge-Cloud Agents
MemPrivacy is a research paper introducing a framework for privacy-preserving personalized memory management in edge-cloud AI agents, using type-aware placeholders to protect sensitive data while maintaining semantic utility. It includes a new benchmark dataset and demonstrates superior performance over general-purpose models like GPT-5.2 and Gemini-3.1-Pro.
The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements
This paper audits LangChain, AutoGPT, and OpenAI Agents SDK for architectural safety guarantees and finds no native compliance with containment principles, demonstrating that memory poisoning can cause persistent failures; it introduces lightweight mechanisms to eliminate such attacks.
Project Shadows: Turns out "just add memory" doesn't fix your agent
An analysis exploring limitations in AI agent design, arguing that simply increasing memory capacity is insufficient to address fundamental architectural issues in how agents are built and function.
Two ways my agent security detector was wrong, both found this week
The author describes two bugs found in their AI agent security detector: one where normal agent behavior triggered false positives and latency issues, and another where invisible Unicode characters bypassed detection, both identified through practical testing.