Agent memory needs more than trusted-looking sources

AI agents cannot safely trust saved memory or retrieved documents just because the source looks authenticated. An open-source agent memory core tested four defenses: scoring records by value, requiring corroboration, letting newer records replace older ones in a fixed way, and giving credit to records that seemed to lead to success. All four failed when the attacker knew how the defenses worked.

The weak point was that the record itself supplied the signals used to judge it, so the attacker could write fake value, fake support, convenient timing, or fake success. Provenance and cost are harder for the writer to fake, but provenance only proves where something came from, not whether it is true. False memory can still enter through a real, authenticated session and pass a source check.

Related tests point to the same pattern: RAG can quote the right text while pointing to the wrong source about 30% of the time, source and corroboration metadata can be forged, and a cached fact can become stale even though it still fits the context perfectly. The safer rule is to make memory cheap to store but expensive to use for broader influence, by requiring separate anchored evidence before it shapes an answer outside its original scope.