Lion Cipher Lab

Poison an AI agent's long-term memory, then detect it and shut it down: the compromise that survives the session

• AI Security
• Advanced
• ~75 min
• Free · no account required

Why it matters

Almost every serious AI agent shipped in the last two years grew a memory: a 'remember this for next time' store, so it stops forgetting your name, your stack and your preferences between sessions. That feature is also a write path from untrusted content straight into the system context of every future session. One poisoned document, one crafted tool result, one hostile web page gets summarised into memory - and then the attacker goes home, and the instruction keeps firing, in clean sessions, for unrelated users, on unrelated tasks, with nothing malicious left on disk to find. That is the…

What you'll learn

• stating the memory-poisoning threat model precisely: a write path from untrusted content into future system context
• building a toy agent with a persistent memory store, an auto-summarising write path, and a session loader
• planting a benign placeholder instruction and proving it fires in a CLEAN session with the attacker and the document gone
• measuring a persistence Attack Success Rate (ASR) across many clean sessions and unrelated tasks, per payload phrasing
• detecting poisoning four ways: memory provenance, an imperative-vs-fact classifier, an append-only audit log and diff, and a canary probe
• measuring a detection classifier's own precision and recall before trusting its verdicts
• defending in layers and pricing each layer: keyword blocklist, structural classifier, write-gating, quarantine, TTL, capability separation
• running the memory-poisoning incident-response sequence: contain, scope, eradicate memory AND source AND snapshot, recover, learn
• judging when an agent should have persistent memory at all, and treating the memory store as a security boundary

Steps in this lab

1. The threat model, stated precisely: a write path into every future session
2. Where this sits in the published taxonomies - and how it differs from its neighbours in this catalog
3. Build the vulnerable agent: a memory store, an auto-summarising write path, and a session loader
4. Session 1: plant the placeholder and watch the write path swallow it
5. The payoff: a clean session, no attacker, no document - and it still fires
6. Measure it: a persistence Attack Success Rate, so every defense gets a number
7. Detect it, part 1: provenance, and an imperative-vs-fact classifier that measures itself
8. Detect it, part 2: the append-only audit log and the memory diff
9. Detect it, part 3: a canary probe that catches what everything else missed
10. Defend it in layers - and put a number on every single layer
11. Two structural controls content inspection can never give you: capability separation, and TTL
12. Failure mode: sanitising on READ instead of on WRITE
13. The failure modes you cannot code around - name them so you can argue about them
14. Incident response: you found a poisoned memory in production - now what, in order
15. When an agent should have memory at all - and how a pro builds it
16. The judgment: persistence is what turns a trick into an incident

Open the full interactive lab →