Feature: Memory Poisoning (ASI06) Protection — OWASP Agent Memory Guard Reference

[vgudur-dev]

Memory Poisoning (ASI06) in AgentOps — OWASP Reference

AgentOps is increasingly used in production AI agent workflows where agents read from external sources and write results into memory or pass them to downstream components.

This creates a critical attack surface: ASI06 — Memory Poisoning, defined in the OWASP Top 10 for Agentic Applications 2025.

The attack: A malicious payload embedded in an external source is processed by an agent and written into memory. Downstream components then execute based on the poisoned memory, leading to data exfiltration or full workflow compromise.

OWASP Agent Memory Guard

The OWASP Agent Memory Guard project provides a lightweight reference implementation of a scan-before-write pattern:

from agent_memory_guard import MemoryGuard, GuardPolicy

guard = MemoryGuard(policy=GuardPolicy.BLOCK)
result = guard.scan(external_content)
if result.is_safe:
    agent_memory.write(result.sanitized_content)

Already being discussed and adopted by maintainers of LangGraph, LiteLLM, AutoGen, and Flowise.

Would the AgentOps team be open to referencing this pattern in the security docs or integrating a memory validation step?