AG5Assure AI agent scope
Memory and context integrity assessment
Agents that remember can be made to remember the wrong things. AG5 maps what writes to memory and what reads it, and tests whether an outsider can plant a falsehood.
Price on requestAsk about AG5How pricing works
What it is for
Persistent memory makes an agent more useful and gives an attacker somewhere to hide. A false “fact” written into memory today shapes the agent’s answers next month, long after the message that planted it is gone.
The MemGhost research note of July 2026 showed that one crafted email to an inbox an agent monitors could make the agent silently write attacker-chosen falsehoods into its persistent memory. Its recommended mitigations: limit memory writes for unattended agents, route untrusted email through a reader that cannot write to memory, tag and confirm externally sourced entries, log all memory changes, and test memory-write defences directly.[1]
What we look at
- Every component that can write to memory, and on whose input.
- Whether memory entries carry their source, and whether the agent treats sources differently.
- Whether readers of untrusted content hold write access to memory.
- How memory is reviewed, corrected and purged.
OWASP lists the risk as ASI06 Memory & Context Poisoning.[2]
What you receive
A write and read map, a provenance tagging design, the results of memory-poisoning tests, and a purge policy.
Framework mapping
The frameworks this scope is aligned with, the version we map to, and what we map. Aligned with means we use the framework; it does not mean any body has certified TriOngle.
| Framework | Version | What we map |
|---|---|---|
| OWASP Top 10 for Agentic Applications | 2026 edition, 9 Dec 2025[3] | ASI06 Memory & Context Poisoning |
| MemGhost: persistent memory poisoning | 23 Jul 2026[1] | Single-message memory poisoning and its mitigations |
| MITRE ATLAS | Monthly releases; data version 2026.05[4][5] | Technique ID for every test case |