{"resourceId":"aws-agentcore-memory-poisoning-write-validation-20261109","versions":[{"version":"external-634640bbc8712dafeacf4eee6047847aef8330cd501be10a6a2368479df5cd16","resource":{"id":"aws-agentcore-memory-poisoning-write-validation-20261109","title":"AWS publishes a write-time memory-poisoning defense for Bedrock AgentCore, tested on 11 demo scenarios and leaving composition to customers","organization":"Amazon Web Services","sector":"Cross-SLED AI agent security","geography":"Not region-specific (tests in US East (N. Virginia))","publishedAt":"2026-11-09","publicationDate":"2026-11-09","eventDate":"2026-11-09","sourceName":"AWS Security Blog","sourceLabel":"Help defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validation","sourceUrl":"https://aws.amazon.com/blogs/security/help-defend-against-memory-poisoning-in-amazon-bedrock-agentcore-with-multi-layer-write-validation/","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","data-security"],"finding":"An AWS ProServe post (November 9, 2026) describes memory poisoning as persistent indirect prompt injection and offers a sample Lambda interceptor on AgentCore Gateway that scores memory writes on semantic drift (40%), instruction patterns (25%), namespace boundary (25%) and write rate (10%), returning ALLOW, QUARANTINE or DENY. In a demo of 11 scenarios (3 benign, 8 attacks) using a keyword-overlap stand-in for Titan embeddings, all decisions matched expectations; added latency was about 26 ms warm and cost about $2.50 per day for 10,000 writes. Writes made directly through the SDK bypass the Gateway check.","sledRelevance":"Agencies and universities building agents that remember residents, students or cases across sessions face a persistence risk that ordinary prompt filtering misses. The post gives a concrete pattern, but it is a sample to adapt and test, not a managed control.","evidence":"Vendor sample with a small self-run demo; the demo used a simplified similarity method and results are not independently evaluated. Prior independent research (Zenity's AgentCorruption work, archived) also described memory poisoning as an attack outcome.","architectureImplications":"Pre-write Lambda interceptor on AgentCore Gateway, DynamoDB for rate tracking and audit, SNS alerts, Titan Text Embeddings V2, Cedar policies in AgentCore Policy as a secondary layer; deployable via AWS CDK from an aws-samples repository.","governanceImplications":"Quarantine namespace and alerting create an audit trail; agencies must decide fail-open versus fail-closed (AWS suggests BLOCK for high-security environments).","securityPrivacyImplications":"Addresses cross-session and cross-user contamination in shared namespaces; does not cover writes that bypass Gateway unless additional controls are added.","caveats":"Eleven-case demo with a substitute similarity method; scores may change with real embeddings. Not a managed AWS feature.","streamIds":["aws"],"roles":{"sales":"Interpretation: use this to show that agent memory needs its own security design. The customer problem is a resident- or student-facing agent that stores context across sessions, where one malicious input could affect later users. Stakeholders are the CISO, the agent product owner and privacy staff. Discovery should ask whether agents use long-term or shared memory and how writes are reviewed. A bounded engagement is a memory-threat review. Do not present the 11-case demo as proof of protection; it is a sample result.","engineering":"Interpretation: good architectural fit for AgentCore deployments that use Memory through Gateway. Engineers would adapt the CDK sample, swap in real Titan embeddings, set fail-closed behavior for sensitive agents and add Cedar namespace policies. Prerequisites include AgentCore Runtime, Memory, Gateway and Policy. Constraints: direct SDK writes bypass the check, and thresholds need tuning on real traffic. A proof of value should replay agency-specific attack and benign writes, including Spanish and other service languages, and measure false quarantines.","delivery":"Interpretation: delivery work is hardening and operating the memory-write path. Dependencies are an AgentCore Gateway architecture, a test corpus of benign and malicious writes and a reviewer for quarantined items. Ownership sits with the agent platform team, with security operations receiving alerts. Governance checkpoints include threshold approval, fail-mode decision and periodic pattern updates. Proposed acceptance criteria are measured false-quarantine and miss rates on the agency's corpus. Risks include SDK bypass paths and alert fatigue."},"roleDetails":{"sales":{"customerProblem":"Agents with persistent or shared memory can be poisoned so that one malicious input influences later sessions and users.","stakeholders":["CISO","Agent product owner","Privacy officer","Security operations"],"discoveryQuestions":["Do agents use long-term or shared memory namespaces?","Can any path write to memory without passing Gateway?","Which languages must detection handle?"],"valueHypothesis":"Write-time validation may reduce persistent prompt-injection risk; effectiveness on real traffic is unmeasured.","potentialEngagement":"Memory-threat review and adaptation of the sample with an agency-specific test corpus.","unsupportedClaims":["Proven protection rates","Coverage of SDK-direct writes","Production-ready managed control"]},"engineering":{"fit":"Good fit for AgentCore deployments using Memory through Gateway.","architectureIntegration":"Lambda pre-write interceptor on Gateway with DynamoDB, SNS, Titan embeddings and Cedar policies.","prerequisites":["AgentCore Runtime with Memory","AgentCore Gateway","AgentCore Policy (Cedar)"],"constraints":["SDK-direct writes bypass check","Demo used substitute similarity method","Thresholds require tuning"],"security":"Quarantine isolation, fail-closed option and alerting; protect quarantine contents as potentially malicious.","proofOfValue":["Replay benign and malicious writes in service languages","Measure false-quarantine and miss rates","Verify SDK paths are blocked or validated"]},"delivery":{"work":"Harden and operate the agent memory-write path.","dependencies":["Gateway-based architecture","Test corpus","Quarantine reviewer"],"ownership":"Agent platform team; SecOps receives alerts.","skillsAdoption":"Engineers need prompt-injection testing and threshold-tuning skills.","governanceCheckpoints":["Threshold approval","Fail-mode decision","Pattern update schedule"],"acceptanceCriteria":["Proposed: false-quarantine rate below an agreed level on agency corpus","Proposed: all test attacks quarantined or denied","Proposed: no unvalidated write path"],"risks":["SDK bypass","Alert fatigue","Thresholds drift as attacks evolve"]}},"retrievedAt":"2026-11-10T04:05:45Z","enrichedAt":"2026-11-10T04:11:25Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Semantic drift is designed to catch non-English and obfuscated injections, relevant to multilingual resident services, but only tested on a few examples.","procurementImplications":"Open-source sample; operating costs depend on volume.","operatingModelImplications":"Thresholds and regex patterns need ongoing tuning; quarantined content needs a review owner.","sourceVerification":{"openedUrl":"https://aws.amazon.com/blogs/security/help-defend-against-memory-poisoning-in-amazon-bedrock-agentcore-with-multi-layer-write-validation/","referenceExcerpt":"In this test set, the pipeline returned the expected decision for all 11 scenarios.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}