Agent memory poisoning and integrity

An agent's memory is an attack surface. Anything an agent reads can end up written, and anything written comes back as precedent the next time conditions look similar. OWASP lists memory and context poisoning as ASI06 in its Top 10 for Agentic Applications. Causal does not filter on the way in. Every memory carries its evidence, and a write that contradicts corroborated experience has to outweigh that evidence.

How does Causal defend agent memory from poisoning?

A poisoned write competes with what your agents already learned. The experience with more evidence behind it wins, and the losing write is revoked.

Nothing in that resolution turns on recency, or on trusting whoever wrote last. A write that claims to supersede an existing experience is adjudicated against the evidence standing behind that experience — the attempts that produced it and the outcomes that corroborated it. When three attempts converge on the same conclusion and a lone write arrives to overturn it, the lone write loses: its superseding edge is dropped and the write is revoked.

The graph is what makes this possible. Facts stored as isolated assertions have nothing to weigh. Experience recorded as cause, effect, and the outcomes observed in between gains corroboration every time another attempt agrees with it. Memory that only stores context is overwritten by whatever was written last. Memory that records what was tried and what happened holds evidence a write has to beat.

Connector ingest

Causal reads from the systems the company already runs — Slack, GitHub, Jira, Linear, Notion, Salesforce, SAP. Ingest is episodic and firewalled: nothing a connector reads can become an instruction, so a hostile message in a channel cannot program your agents. A Slack thread arrives as something that was said, not as something to do. What each connector contributes is on Agent memory with integrations.

When a memory is compromised

Three controls, named in the trust model:

• Quarantine and taint propagation. A compromised memory is marked, and the taint follows the edges to whatever derived from it. Contamination is traced through the graph rather than assumed to be contained.
• Supersedence. A stale or wrong lesson is superseded without its history being erased. The old entry stays readable, and the trail shows what replaced it and when.
• Revocation. Data can be revoked outright, and any memory or the whole account can be deleted.

A quarantined memory is dropped from serving while the taint is traced.

Supersedence is the reason the record survives correction. Erasing a bad memory would destroy the proof that it was ever served, and that proof is what shows why the agent acted.

Whether the record can be checked without trusting Causal, who can read and write a shared graph, and where the deployment runs are on AI agent governance and audit trail.