OWASP Agent Memory Guard 🏆 Official OWASP Lab Project · reference implementation for ASI06: Memory & Context Poisoning Stop AI agents from being weaponized through their own memory. Runtime defense that catches memory poisoning — even after a context reset. 📦 25,330 PyPI downloads · 18,009 repository clones · 43,339 total Created and led by Vaishnavi Gudur, with co-leader Anshul Rajkumar — OWASP Agent Memory…
Created and led by Vaishnavi Gudur, with co-leader Anshul Rajkumar — OWASP Agent Memory Guard.
Official OWASP Foundation project addressing ASI06 (Memory & Context Poisoning).
⭐ If AMG helps you secure your agents, star the repo — stars are how other security teams find it.
That’s it. Three lines to protect your agent’s memory. No API keys. No external calls. Runs locally at 62 µs median latency.
See it stop real poisoning attempts in 30 seconds
Clone the repo and run the demo — four legitimate memories go through, five poisoning attempts are blocked, redacted or quarantined. No API keys, no network calls.
Modern AI agents persist memory across sessions. Anything written into that memory becomes a privileged input on the next turn. An attacker who plants text in the wrong field can override instructions, exfiltrate data, or hijack tool calls — and the attack survives context resets, because the memory does.
Existing defenses run on user input at the front of the loop. Memory poisoning runs on memory itself. Different surface, different problem.
Agent Memory Guard sits between the agent and its memory store, screening every operation through a pipeline of detectors and a declarative policy.
Benchmark results
Measured on the project’s 55-case benchmark: 40 representative attack payloads across 4 threat categories plus 15 benign controls (AMG 0.2.2, run of 2 May 2026; full report):
The numbers above measure AMG’s own detectors on single writes. The Agent
Memory Security Benchmark is a separate, framework-neutral scoreboard that
grades any memory system on the full poisoning lifecycle — a payload is
planted, survives a context reset, and is read back on a later turn. Any
system that implements a three-method adapter (remember / recall /
context_reset) gets a 0–100 resilience score and an SSL-Labs-style letter
grade, with hard grade ceilings for catastrophic breaches.
AMG authors the benchmark and submits itself for grading, measured through
the identical adapter and corpus as every other entry. The results are not
curated to flatter it:
System
Grade
Score
Notes
agent-memory-guard (hardened)
A
93.9
declared protected keys + persistence detector
agent-memory-guard (strict preset)
D
71.4
Policy.strict() — declared protected keys, no persistence detector
unguarded-dict
F
0.0
the resilience floor
The strict preset scores D: Policy.strict() now declares protected keys
(fixed in 0.3.2, #90)
so it defends the identity-escalation attacks, but it
still loads no persistence detector — the delayed-activation attacks survive a
context reset, and two critical breaches cap the grade at D. A real, honest
finding about the documented quickstart config, surfaced by AMG’s own benchmark:
the benchmark independently confirms the 0.3.2 fix and still flags the residual
persistence gap. See
benchmarks/memory-systems/ for the full
leaderboard, methodology, and how to grade a new system.
amg-bench --out benchmarks/memory-systems # reproduce; grade mem0/Letta/Zep with --systems
What it does
Integrity — SHA-256 baselines flag out-of-band tampering with immutable keys.
Threat detection — built-in detectors for prompt injection, secret/PII leakage, protected-key modifications, size anomalies, and self-reinforcement loops.
Policy enforcement — YAML-defined rules map findings to actions: allow, redact, quarantine, or block.
Forensics — every decision emits a structured SecurityEvent; point-in-time snapshots enable rollback to a known-good state.
Drop-in middleware — ships with GuardedChatMessageHistory for LangChain; framework-agnostic MemoryStore protocol covers any backend.
The public clinic Gist — a runnable Policy.strict() repro (~15 min) to see it block a real violation.
After trying the clinic, open an Adopter: <name> — <framework> issue with your stack versions — it’s optional, but it helps us prioritize which integrations to harden next.
This is a community how-to, not a product endorsement: the project is not OWASP-certified, is not MITRE-approved, and the ATLAS AML.M0031 reference is a YAML listing only (see Recognition).
LangChain integration
from agent_memory_guard import MemoryGuard, Policy
from agent_memory_guard.integrations import GuardedChatMessageHistory
history = GuardedChatMessageHistory(
session_id="sess-1",
guard=MemoryGuard(policy=Policy.strict()),
)
LangChain middleware
Full agent protection — model inputs, outputs, and tool outputs (the primary injection vector).
from langchain.agents import create_agent
from langchain_agent_memory_guard import MemoryGuardMiddleware
agent = create_agent(
"openai:gpt-4o",
tools=[my_search_tool, my_db_tool],
middleware=[MemoryGuardMiddleware()], # default: block on violation
)
Optional: pass policy=Policy.strict() or on_violation="warn"|"strip"|"block". After the clinic, open an issue titled Adopter: <name> — LangChain with stack versions.
OpenAI Agents SDK
Screen tool outputs before they enter session memory. Runnable example:
examples/openai_agents_memory_guard.py
(HITL queue on block). Drop-in SDK adapters (GuardedAgentContext, GuardedToolOutput,
GuardedHandoff) ship in agent_memory_guard.integrations.openai_agents.
from agent_memory_guard import MemoryGuard, Policy, PolicyViolation
from agent_memory_guard.events import SourceClass
from agent_memory_guard.storage import InMemoryStore
guard = MemoryGuard(InMemoryStore(), policy=Policy.strict())
def remember_tool_output(tool_name: str, output: str) -> bool:
try:
guard.write(
f"openai_agents.tool.{tool_name}",
output,
source="openai_agents_tool",
source_class=SourceClass.EXTERNAL_TOOL,
)
except PolicyViolation:
return False # enqueue for HITL / eval — do not poison session memory
return True
def recall(key: str) -> str | None:
return guard.read(key, sink="openai-agent")
AutoGen
from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
guard = MemoryGuard(policy=Policy.strict())
def guarded_append(history: list[dict], message: dict) -> None:
key = f"autogen.msg.{len(history)}"
try:
action = guard.write(key, message["content"], source=message.get("role", "agent"))
except PolicyViolation as exc:
print("blocked:", exc)
return
if action == Action.QUARANTINE:
return # held in guard.quarantine for review
history.append({**message, "content": guard.read(key)}) # redacted if needed
mem0
from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
guard = MemoryGuard(policy=Policy.strict())
def safe_add(mem0_client, *, user_id: str, content: str, key: str) -> bool:
try:
action = guard.write(key, content, source="mem0")
except PolicyViolation:
return False
if action == Action.QUARANTINE:
return False # held in guard.quarantine for review
mem0_client.add(guard.read(key), user_id=user_id) # redacted if needed
return True
CrewAI
from agent_memory_guard import Action, MemoryGuard, Policy, PolicyViolation
guard = MemoryGuard(policy=Policy.strict())
def guarded_memory_callback(key: str, value: str, agent_name: str) -> str:
try:
action = guard.write(key, value, source=f"crewai.{agent_name}")
except PolicyViolation as exc:
return f"[BLOCKED] {exc}"
if action == Action.QUARANTINE:
return "[QUARANTINED] held for review"
return guard.read(key) # redacted if needed
Referenced in the MITRE ATLAS “Memory Hardening” mitigation as an open-source implementation of memory-hardening controls.
Featured by Help Net Security, “OWASP Agent Memory Guard: Stop AI agents from being weaponized through their own memory” (June 2026).
These mentions are descriptive, not endorsements. OWASP Lab status is not a certification,
and MITRE has not approved or endorsed this project; the ATLAS Memory Hardening entry lists it
among example tools.
How to cite
Use GitHub’s “Cite this repository” button (powered by CITATION.cff), or:
@software{agent_memory_guard,
author = {Gudur, Vaishnavi and Rajkumar, Anshul},
title = {OWASP Agent Memory Guard: A Runtime Defense and Open Benchmark
for Memory Poisoning in LLM Agents (ASI06)},
url = {https://github.com/OWASP/www-project-agent-memory-guard},
license = {Apache-2.0}
}
License
Apache-2.0 — copyright OWASP Foundation. See LICENSE.md.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)
评论