Write-path security for agent memory
Your agent remembers everything. Including the attack.
MemShield is a firewall for AI agent memory. It screens every memory write for injection and poisoning, detects behavioral drift, and keeps an audit trail of what your agents remember and why.
✓ Open-source core in development · defensive security only
The problem
Poisoned once, trusted forever.
Agent frameworks now ship persistent memory. Once an attacker plants a record through a normal-looking interaction, every future session treats it as ground truth. Teams running agents in customer-facing or regulated settings have no equivalent of input sanitization for the write path.
01It persists
A poisoned write outlives the session that created it. The attacker leaves; the memory stays and keeps steering behavior.
02It hides
Injected records look like ordinary memories. Without drift detection, the change in agent behavior surfaces only after damage is done.
03It can't be audited
Most memory stacks keep no forensic trail. When behavior goes wrong, there is no record of what the agent believes or where a belief came from.
injection success rate against agent memory
The MINJA memory-injection attack plants malicious records in an agent's memory purely through normal user interactions, then steers the agent's behavior in later sessions. No privileged access required.
No production defense ships today. MemShield exists to change that.
source: MINJA, peer-reviewed research published at NeurIPS 2025How it works
A proxy on the write path.
MemShield sits between your agent and its memory store. Nothing is persisted until it has been screened, and everything that happens is recorded.
Drop in front of your store
A proxy that speaks your memory stack's protocol. Point your agent at MemShield instead of the store; no agent code changes.
Screen every write
Each write is classified for injection and manipulation patterns, then checked for semantic consistency against the memory neighborhood it would join.
Hold what looks wrong
Suspicious writes go to a review queue instead of the store. Your team approves or rejects; the agent keeps working without the held memory.
Monitor drift, keep the trail
Canary tasks replay on a schedule to catch behavioral drift after memory changes. Every write, verdict, and review decision lands in an append-only audit log.
What ships
Built for the stacks teams already run.
Framework adapters
First-class adapters for the memory layers agents actually use, plus a generic proxy for MCP memory servers and custom stores via the SDK.
Readable before you run it
The proxy, screening engine, and adapters will be open source. Security middleware you can read before you put it in front of your agents.
Memory security benchmark
A reproducible suite that runs published MINJA-class attack patterns against your own test stack, so you can measure your exposure and verify your defenses.
Audit trail
An append-only record of every memory write, screening verdict, and reviewer decision. When someone asks why the agent believes something, you have the answer.
Where we are
In development, in the open.
- Now: reproducing published memory-poisoning attacks against open-source memory stacks in our own test environments, and building the screening proxy.
- Next: open-source release of the core proxy and adapters, plus the public benchmark suite.
- No customers yet, no invented numbers. The only figure on this page comes from peer-reviewed research.
one email when the core ships · no spam
FAQ
Questions teams ask us.
Is MemShield an offensive security tool?+
No. MemShield is defensive only. The benchmark suite reproduces published attack patterns strictly against your own test environments, so you can measure whether your defenses hold. We do not build or distribute tooling for attacking systems you do not own.
Does screening slow my agent down?+
Screening runs on the write path only; reads are untouched, so retrieval latency does not change. Writes get a fast first-pass classification, and only suspicious ones escalate to deeper checks or the quarantine queue.
Which memory stacks are supported?+
Adapters for Mem0, Letta, and Zep are first in line, alongside a generic proxy for MCP memory servers. Custom stores can integrate through the SDK.
What happens to a quarantined memory?+
It is held in a review queue and never reaches the store. The agent continues operating without it. A reviewer approves or rejects it, and that decision is recorded in the audit trail with the original write and the screening verdict.
Is it open source?+
The core will be: the proxy, the screening engine, and the framework adapters. A hosted tier with a dashboard, alerting, and retention policies is planned for teams that want it managed.