From the AWS edition of November 9, 2026
AWS publishes a write-time memory-poisoning defense for Bedrock AgentCore, tested on 11 demo scenarios and leaving composition to customers
Amazon Web Services · Cross-SLED AI agent security · Not region-specific (tests in US East (N. Virginia))
- Publisher
- AWS Security Blog
- Original publication
- 2026-11-09
- Source retrieved
- 2026-11-10
- Event date
- 2026-11-09
What happened
An AWS ProServe post (November 9, 2026) describes memory poisoning as persistent indirect prompt injection and offers a sample Lambda interceptor on AgentCore Gateway that scores memory writes on semantic drift (40%), instruction patterns (25%), namespace boundary (25%) and write rate (10%), returning ALLOW, QUARANTINE or DENY. In a demo of 11 scenarios (3 benign, 8 attacks) using a keyword-overlap stand-in for Titan embeddings, all decisions matched expectations; added latency was about 26 ms warm and cost about $2.50 per day for 10,000 writes. Writes made directly through the SDK bypass the Gateway check.
Why it matters
Agencies and universities building agents that remember residents, students or cases across sessions face a persistence risk that ordinary prompt filtering misses. The post gives a concrete pattern, but it is a sample to adapt and test, not a managed control.
Evidence and measured results
Vendor sample with a small self-run demo; the demo used a simplified similarity method and results are not independently evaluated. Prior independent research (Zenity's AgentCorruption work, archived) also described memory poisoning as an attack outcome.
Limitations and uncertainty
Eleven-case demo with a substitute similarity method; scores may change with real embeddings. Not a managed AWS feature.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agents with persistent or shared memory can be poisoned so that one malicious input influences later sessions and users.
- Stakeholders
- CISO
- Agent product owner
- Privacy officer
- Security operations
- Discovery questions
- Do agents use long-term or shared memory namespaces?
- Can any path write to memory without passing Gateway?
- Which languages must detection handle?
- Value hypothesis
- Write-time validation may reduce persistent prompt-injection risk; effectiveness on real traffic is unmeasured.
- Potential engagement
- Memory-threat review and adaptation of the sample with an agency-specific test corpus.
- Unsupported claims
- Proven protection rates
- Coverage of SDK-direct writes
- Production-ready managed control
Pre-sales engineering
Role takeaway
- Fit
- Good fit for AgentCore deployments using Memory through Gateway.
- Architecture and integration
- Lambda pre-write interceptor on Gateway with DynamoDB, SNS, Titan embeddings and Cedar policies.
- Prerequisites
- AgentCore Runtime with Memory
- AgentCore Gateway
- AgentCore Policy (Cedar)
- Constraints
- SDK-direct writes bypass check
- Demo used substitute similarity method
- Thresholds require tuning
- Security
- Quarantine isolation, fail-closed option and alerting; protect quarantine contents as potentially malicious.
- Proof of value
- Replay benign and malicious writes in service languages
- Measure false-quarantine and miss rates
- Verify SDK paths are blocked or validated
Delivery
Role takeaway
- Work
- Harden and operate the agent memory-write path.
- Dependencies
- Gateway-based architecture
- Test corpus
- Quarantine reviewer
- Ownership
- Agent platform team; SecOps receives alerts.
- Skills and adoption
- Engineers need prompt-injection testing and threshold-tuning skills.
- Governance checkpoints
- Threshold approval
- Fail-mode decision
- Pattern update schedule
- Acceptance criteria
- Proposed: false-quarantine rate below an agreed level on agency corpus
- Proposed: all test attacks quarantined or denied
- Proposed: no unvalidated write path
- Risks
- SDK bypass
- Alert fatigue
- Thresholds drift as attacks evolve
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Pre-write Lambda interceptor on AgentCore Gateway, DynamoDB for rate tracking and audit, SNS alerts, Titan Text Embeddings V2, Cedar policies in AgentCore Policy as a secondary layer; deployable via AWS CDK from an aws-samples repository.
Governance
Who approves, reviews and stays accountable for outcomes?
Quarantine namespace and alerting create an audit trail; agencies must decide fail-open versus fail-closed (AWS suggests BLOCK for high-security environments).
Security and privacy
What data, permissions and controls need testing?
Addresses cross-session and cross-user contamination in shared namespaces; does not cover writes that bypass Gateway unless additional controls are added.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Semantic drift is designed to catch non-English and obfuscated injections, relevant to multilingual resident services, but only tested on a few examples.
Procurement
What should contracts, pricing and exit terms secure?
Open-source sample; operating costs depend on volume.
Operating model
Which teams own the service once it runs?
Thresholds and regex patterns need ongoing tuning; quarantined content needs a review owner.
Publication history
- 2026-11-09AWS · Issue 118 resources
Stable resource ID: aws-agentcore-memory-poisoning-write-validation-20261109