mlsanityData to 14 Oct 2026

A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle

arXiv 2604.16548 ↗First posted 17 Apr 2026cs.CR cs.AI cs.CLcited by 27

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation. To systematically characterize this landscape, we propose a Memory Lifecycle Framework that organizes attacks, defenses, and their cross-phase dependencies along two axes: six lifecycle phases (Write, Store, Retrieve, Execute, Share & Propagate, Forget & Rollback) and four security objectives (Integrity, Confidentiality, Availability, Governance). This analysis in turn exposes the need for formal security guarantees at the system level, motivating Verifiable Memory Governance (VMG), a framework of five architectural primitives that specifies what verifiable mechanisms a long-term-memory system must provide to maintain auditable, recoverable control over its memory state. Our analysis indicates that robust Long-Term Memory (LTM) security cannot be retrofitted at retrieval or execution time alone, but must be anchored in storage-time provenance, versioning, and policy-aware retention from the outset.

Key facts. Cited by 27 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 54 of its 86 references that are in the map. First posted on arXiv 17 Apr 2026.

Builds on

54 of 86 references.

Closest ancestors · 20

Same direction, newest first

  1. 2026Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents3 Apr
  2. 2026No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents1 Apr
  3. 2026From Storage to Steering: Memory Control Flow Attacks on LLM Agents16 Mar
  4. 2026Contextualized Privacy Defense for LLM Agents3 Mar
  5. 2026Formal Policy Enforcement for Real-World Agentic Systems18 Feb
  6. 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections17 Feb
  7. 2026AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems12 Feb
  8. 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval18 Dec
  9. 2025A Vision for Access Control in LLM-based Agent Systems13 Oct
  10. 2025Preventing Prompt Injection with Type-Directed Privilege Separation30 Sep
  11. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
  12. 2025BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks11 Aug
8 more
  1. 2025Progent: Securing AI Agents with Privilege Control16 Apr
  2. 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
  3. 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
  4. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  5. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies28 Jul
  6. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
  7. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
  8. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb

Other references · 34

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,242
  3. 2020Extracting Training Data from Large Language Modelscited by 2,189
  4. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,453
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  6. 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
  7. 2019Machine Unlearningcited by 1,061
  8. 2024Evaluating Very Long-Term Conversational Memory of LLM Agentscited by 830
  9. 2024LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memorycited by 707
  10. 2024A Survey on the Memory Mechanism of Large Language Model based Agentscited by 634
  11. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  12. 2025Memory in the Age of AI Agentscited by 303
22 more
  1. 2025Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactionscited by 254
  2. 2024Seven Failure Points When Engineering a Retrieval Augmented Generation Systemcited by 139
  3. 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
  4. 2025From Human Memory to AI Memory: A Survey on Memory Mechanisms in the Era of LLMscited by 124
  5. 2025Collaborative Memory: Multi-User Memory Sharing in LLM Agents with Dynamic Access Controlcited by 61
  6. 2024Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applicationscited by 59
  7. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 49
  8. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generationcited by 40
  9. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysiscited by 33
  10. 2025PROV-AGENT: Unified Provenance for Tracking AI Agent Interactions in Agentic Workflowscited by 31
  11. 2025CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent Memory in LLMscited by 26
  12. 2024When Machine Unlearning Meets Retrieval-Augmented Generation (RAG): Keep Secret or Forget Knowledge?cited by 24
  13. 2025GraphRAG under Firecited by 24
  14. 2026PersistBench: When Should Long-Term Memories Be Forgotten by LLMs?cited by 21
  15. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 13
  16. 2025AI Meets Brain: Memory Systems from Cognitive Neuroscience to Autonomous Agentscited by 12
  17. 2024A Troublemaker with Contagious Jailbreak Makes Chaos in Honest Townscited by 9
  18. 2026Agentic Unlearning: When LLM Agent Meets Machine Unlearningcited by 8
  19. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systemscited by 7
  20. 2026When Personalization Legitimizes Risks: Uncovering Safety Vulnerabilities in Personalized Dialogue Agentscited by 7
  21. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarkscited by 4
  22. 2025VerificAgent: Domain-Specific Memory Verification for Scalable Oversight of Aligned Computer-Use Agentscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 27.

27 papers.

Sort:

By area:

  1. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 18
  2. 2026MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systemscited by 16
  3. 2026MemTX: Transactional Belief Commit for Stateful Agent Memorycited by 15
  4. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 11
  5. 2026MemOps: Benchmarking Lifecycle Memory Operations in Long-Horizon Conversationscited by 7
  6. 2026MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agentscited by 7
  7. 2026Metis: Memory Foundation Modelcited by 7
  8. 2026Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgentscited by 5
  9. 2026Deployment-Time Memorization in Foundation-Model Agentscited by 4
  10. 2026What to Keep, What to Forget: A Rate--Distortion View of Memory Compaction in LLMs and Agentscited by 4
  11. 2026MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repaircited by 4
  12. 2026Mi-Memory: A Lifecycle Memory Framework for Personal AIcited by 3
15 more
  1. 2026Ground Truth First: A Longitudinal Evaluation Instrument for Agent Memory, and the Tenure Crossover in Memory-Architecture Rankingscited by 3
  2. 2026Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happenedcited by 2
  3. 2026TARL: Transaction-Aware Reliable Ledgers for Executable Memory Management in Long-Term Agentscited by 1
  4. 2026Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systemscited by 1
  5. 2026Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Studycited by 0
  6. 2026MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systemscited by 0
  7. 2026Understanding Stage-Wise Utility-Risk Trade-offs in LLM Agent Memorycited by 0
  8. 2026Rethinking Data Quality for AI-Driven Systems: Evidence from Practitioner Interviewscited by 0
  9. 2026The Epistemics of Agent Memory: Measuring, and Governing, the Consolidation Decision in Long-Horizon LLM Agentscited by 0
  10. 2026From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agentscited by 0
  11. 2026Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enoughcited by 0
  12. 2026Workerville: Towards an Organizational Behavior Account of Agent Safetycited by 0
  13. 2026MemForm: Benchmarking Memory Formation Poisoning in LLM Agentscited by 0
  14. 2026EvolvAttack: Backdooring self Evolving VLM Agentscited by 0
  15. 2026From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026MemArchitect: A Policy Driven Memory Governance Layer
  2. 2026Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory
  3. 2026Governing Evolving Memory in LLM Agents: Risks, Mechanisms, and the Stability and Safety Governed Memory (SSGM) Framework
  4. 2026MemLineage: Lineage-Guided Enforcement for LLM Agent Memory
  5. 2026Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents
  6. 2026Governed Shared Memory for Multi-Agent LLM Systems
  7. 2026SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
  8. 2026Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration