None of this is encrypted at rest in the same way a secrets manager would be, and none of it has the audit trail a secrets manager produces. That gap is the core of the problem.<\/p>\n
How does memory poisoning work in practice?<\/h2>\n
Memory poisoning means slipping attacker-controlled content into an agent’s memory so that future sessions behave the way the attacker wants. The entry points that matter today are plugins, skills, and Model Context Protocol (MCP) integrations. Most people find something that looks valuable and plug it in without doing a careful read-through. The user base skews toward people who have never coded before and are now using coding agents to build something, which means the bar for social engineering is low.<\/p>\n
A typical lure looks like a “too good to be true” plugin or skill, for example a claimed Claude Code plugin glitch that promises unlimited tokens even on the free plan. The attacker designs the extension to scan through local agent memory, pull out any credentials it finds, and report those keys, tokens, and other sensitive items back to an API endpoint under the attacker’s control. The extension is the delivery vehicle, the memory is the target, and a trusting user is the bridge between the two.<\/p>\n
What should the first hour of a memory incident look like?<\/h2>\n
When an incident involves an agent with memory, the most useful trace in the first hour is the origin of the poisoned memory. Containment decisions depend on knowing where the memory came from: was it planted through an MCP server, returned inside a tool call response, or written by an insider? Each origin points to a different blast radius and a different kill chain.<\/p>\n
The bigger lesson is upstream. Most of the regret in a memory incident is not about what failed to be preserved, it is about what was allowed into the memory system in the first place. The same logic that argues for blocking phishing emails before they reach inboxes argues for filtering poisoned memories before they are persisted. That is the design goal behind the OWASP reference project Memory Guard, which focuses on detection and filtering rather than on post-incident forensics.<\/p>\n
Why does access control on agent memory lag behind the rest of security?<\/h2>\n
Most agent memory products handle the simple case: an agent session for one user will not leverage memories stored by another user. Where the industry falls short is the harder cases: team-based memory, graduated levels of access, and the policies a security team would expect from a database or an API. The techniques for fine-grained access control on structured data are well understood in application security, database security, and API security, but most agent memory products cannot do those things yet.<\/p>\n
That gap matters because enterprise buyers know what they want. They have lived with role-based access control (RBAC), attribute-based access control (ABAC), and other mature models for years, and they expect comparable controls on agent memory. The product market has not caught up.<\/p>\n
What should a CISO check this quarter?<\/h2>\n
Run at least an informal audit of the agent memory solutions in the organization. Two findings are likely. First, there is no governance over what is being used as agent memory. Leadership may believe no agent memory is in use, yet developers have plugged in random, unvetted solutions on their local workstations or on a small shared server somewhere. Second, the amount of highly sensitive information sitting in plain text, ready for exfiltration, is much larger than expected: leaked keys, database passwords, and confidential business information, plus more that nobody has inventoried.<\/p>\n
The audit’s value is in spotting the security gap and getting it closed before anyone else finds it.<\/p>\n
FAQ<\/h2>\nWhat is stored in coding agent memory?<\/h3>\n
Coding agents store a wide range of developer inputs in long-term memory, including API keys, database passwords, credentials, and sensitive documents. That material often ends up in plain text on developer workstations, in cloud memory services, and in markdown files.<\/p>\n
How does memory poisoning target coding agents?<\/h3>\n
Attackers plant malicious memories through plugins, skills, and MCP integrations, often using social engineering aimed at newer users. A common lure is a “too good to be true” extension that scans agent memory for credentials and reports any keys, tokens, or sensitive items it finds back to the attacker.<\/p>\n
What should a CISO do first about agent memory risk?<\/h3>\n
Run an informal audit of every agent memory solution in use across the organization. The audit typically reveals two problems: no governance over what developers have installed, and large amounts of sensitive data sitting in plain text inside agent memory stores.<\/p>\n
SEOScanPro<\/h2>\n
SEOScanPro has the site audit tool runs a full technical audit of a site and shows the measured result behind every check. Open the site audit tool<\/a>.<\/p>\n![\"The](\"https:\/\/seoscanpro.ai\/shots\/site-audit-v4.webp\")
<\/a><\/p>\n