research: memory and RAG poisoning detection module

[ksek87]

Problem

MemoryGraft (AgentLAB, arXiv:2602.16901, Feb 2026) demonstrated that an attacker can poison an LLM agent's long-term memory by planting malicious entries through benign-looking content — the payload activates weeks or sessions later. MINJA (NeurIPS 2025) showed the same via normal conversation queries. PoisonedRAG (USENIX Security 2025) showed that inserting a small number of crafted documents into a retrieval corpus causes reliable attacker-controlled answers.

This attack class maps to OWASP Agentic ASI06: Memory & Context Poisoning — one of the seven categories in the 2025 Agentic Top 10. No current MCP scanner addresses it.

MCP servers that expose resources/list or memory/search tools are the attack surface: an adversarial server can return retrieval results containing embedded steering instructions that persist into the agent's next session.

Research questions

1. What MCP tool patterns indicate a server has a persistent memory or RAG store? (tool names like remember, store_context, search_memory, retrieve)
2. What do MemoryGraft/MINJA payloads look like in practice — can fuzzd detect them statically?
3. What dynamic probing is possible: call memory-write tools with injection payloads, then call memory-read tools and scan responses for round-tripped injections?
4. What corpus records are needed?

Proposed approach (to be validated by research)

1. Static: new signal MemoryPoisoningVector — fires when a tool's description instructs the agent to store content retrieved from an external source without sanitization (combines RawContentPassthrough + memory-write semantic)
2. Dynamic: for tools that appear to be memory-write operations, call them with embedded injection payloads, then call the corresponding read operation and scan the response for the injected content (round-trip test)
3. Corpus: add memory-poisoning payload records

Acceptance criteria (research phase)

• Written evaluation of MemoryGraft/MINJA/PoisonedRAG attack payloads: which are detectable statically?
• Proposed signal definition for memory-poisoning vectors
• Prototype corpus record for the clearest memory-poisoning attack class
• Go/no-go recommendation for a full --attacks memory module

References

• AgentLAB / MemoryGraft: https://arxiv.org/pdf/2602.16901
• OWASP Agentic ASI06: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
• WorkOS memory poisoning: https://workos.com/blog/ai-agent-memory-poisoning