Prompt Injection Defense

2026-06-22

Your agent's memory outlives the session. So does the attack.

Memory poisoning is a distinct threat class from prompt injection: instead of hijacking a live session, a single adversarial write corrupts an agent's persistent memory store and silently steers behavior across every future session. Pritam Dash et al. (arXiv:2606.04329, June 3, 2026) provide the first systematic study — 4 write channels, 9 structural vulnerabilities, 6 attack classes, and MPBench results showing 50.46% average ASR and 41.05% RSR across OpenClaw and HERMES. Existing prompt injection classifiers fail structurally on weak-signal attacks (PromptArmor drops from 84.4% to 42.5% TPR), because the defense must operate at the write path, not the input boundary. The article provides a 7-section production-ready Python MemoryGuard middleware synthesizing VMG, OWASP Agent Memory Guard, HMAC signed writes, contradiction detection, and bitemporal rollback, along with three prioritized configuration steps to ship.

Prompt Injection Defense

One skill can make a correct task 92% slower — ship this trajectory gate

A public issue triggered a maintainer agent — ship this handoff gate

A Word file can turn Copilot into a prompt worm — ship this boundary

A fake approval made five CI/CD agents ship clean-looking malicious code

LogInject turns security logs into dormant prompt injections

Ghostcommit hides orders in PNGs

DuneSlide turns paths into RCE

Gaslight tricks the analyst, not the sandbox

Your agent's memory outlives the session. So does the attack.

Your agent read that file. Now it's infected.

Your model scored 2.7% on jailbreak benchmarks — and still broke at turn 8

One click owns your agent: the ClawHavoc MCP supply chain attack and how to harden against it