David H. Yang and colleagues introduce MemoryDojo, a benchmark that tracks malicious instructions through an assistant’s memory. It measures whether poison is stored, retrieved, copied into newer memories and obeyed during later tasks.
An attacker alters one external tool result. Ordinary tasks then continue with fresh contexts and persistent memory. The 155 task sequences span four sandboxed domains and compare A-MEM, Graphiti, Letta, Mem0 and Memora.
- On 93 same-domain sequences with GPT-5.6-Luna, optimized attacks raise Letta’s affected share of later tasks from 15.30% to 46.26%. A-MEM rises from 21.02% to 44.01%.
- Those percentages exclude the injection session. They measure subsequent actions, not merely whether a malicious string survives in storage.
- Preloading benign conversation history changes the result. In the separate history-prefixed, mixed-domain condition, Letta has zero observed later-task attack success; Memora reaches 5.32% of later tasks.
- Memora’s lower task-level figure still corresponds to 45.16% of trajectories containing at least one successful later attack. Task frequency and affected sequences are different denominators.
The integrations supply different kinds and amounts of context. Graphiti returns relation facts; Letta adds persistent core blocks; Memora can expand a benign fact into its poisoned source episode. These results compare complete integrations rather than isolating memory architecture.
Caveat: These are sandboxed, author-reported comparisons, not real-world compromise rates or a universal security ranking; benchmark code and data are promised for later release.
For a persistent assistant, inspect the full retrieved context and later actions as well as saved notes. The study shows that completing legitimate tasks can coexist with unwanted additional behavior. It does not validate a defense against that behavior.