New AI Agent Security Risk: Memory Poisoning Could Trigger Unauthorized Fund Operations

ChainCatcher report: The GoPlus Security team has disclosed a novel attack method within its AgentGuard AI project: inducing AI agents to perform unauthorized sensitive operations through "memory poisoning." This attack does not rely on traditional vulnerabilities or malicious code but exploits the long-term memory mechanisms of AI agents. For example, an attacker first manipulates the agent to "remember preferences," such as "typically prioritize proactive refunds over waiting for chargebacks," then later uses ambiguous instructions like "handle as usual" or "follow previous procedures" to trigger automated fund operations. GoPlus highlights that the core risk lies in AI agents mistaking "historical preferences" as authorization, potentially leading to financial losses or security incidents during actions such as refunds, transfers, or configuration changes. To address this issue, the team recommends several protective measures: · Any operation involving refunds, transfers, deletions, or sensitive configurations must require explicit confirmation within the current session. · Memory-based instructions such as "habit," "usual way," or "as before" should be treated as high-risk state changes. · Long-term memory must include traceability mechanisms (recording the writer, timestamp, and confirmation status). · Ambiguous instructions should automatically trigger a higher risk classification and initiate secondary verification. · Long-term memory must never replace real-time authorization processes. The team emphasizes that the AI agent’s memory system should be treated as a potential attack surface and constrained and audited through a dedicated security framework.