AI Memory Security Guide

Use this guide when your system stores conversation summaries, user preferences, notes, plans, or reusable state. Memory is useful because it survives across requests. That is also what makes it dangerous when attacker-controlled content gets promoted into it.

Assumptions

Your application has a memory or state layer that can persist across model calls.
You can control which events are allowed to write into that layer.
Anthale can evaluate both the write path and the replay path around stored content.

Secure the memory layer

Decide what is allowed into memory

Separate durable facts, short-lived task state, user preferences, and generated summaries. Not every useful string belongs in long-term storage.

Tag memory by source and trust level

Record whether the content came from a user, a retrieved document, a tool result, another agent, or a model summary. Provenance matters when you replay the memory later.

Evaluate before write and before replay

Run Anthale before content is persisted and again before saved content is merged back into model context. A clean write path does not guarantee a safe replay path forever.

Keep summaries from becoming policy

Store summaries as context, not as hidden instruction. A model-generated note should not silently upgrade itself into a higher-authority rule for future tasks.

Expire or review privileged memory

Put retention limits and review paths around memory that can affect access, workflow routing, or high-impact tool use.

Test for persistence attacks

Check whether one malicious note, summary, or retrieved chunk can keep influencing later sessions after the original trigger is gone.

Persistent prompt injection is harder to spot than one-shot injection because the source often disappears from the current request while the bad instruction survives in stored state.

What this looks like in code

from os import environ

from anthale import Anthale

client = Anthale(api_key=environ["ANTHALE_API_KEY"])
MEMORY_WRITE_POLICY_ID = environ["ANTHALE_MEMORY_WRITE_POLICY_ID"]
MEMORY_REPLAY_POLICY_ID = environ["ANTHALE_MEMORY_REPLAY_POLICY_ID"]

def sanitize_memory_write(entry: dict) -> dict | None:
response = client.organizations.policies.enforce(
policy_identifier=MEMORY_WRITE_POLICY_ID,
direction="input",
messages=[{"role": "user", "content": entry["content"]}],
metadata={
"boundary": "memory_write",
"feature": "support-agent",
"sourceType": entry["source_type"],
"memoryKind": entry["memory_kind"],
},
)
if response.action == "block":
return None

    safe_content = response.redacted_messages[0]["content"] if response.action == "redact" else entry["content"]
    return {**entry, "content": safe_content}

def build_memory_context(memory_entries: list[dict]) -> list[dict]:
safe_context: list[str] = []
for entry in memory_entries:
response = client.organizations.policies.enforce(
policy_identifier=MEMORY_REPLAY_POLICY_ID,
direction="input",
messages=[{"role": "user", "content": entry["content"]}],
metadata={
"boundary": "memory_replay",
"feature": "support-agent",
"sourceType": entry["source_type"],
"memoryKind": entry["memory_kind"],
},
)
if response.action == "block":
continue

        safe_messages = response.redacted_messages if response.action == "redact" else [{"content": entry["content"]}]
        safe_context.append(safe_messages[0]["content"])

    return [{"role": "system", "content": "Saved memory:\n" + "\n".join(safe_context)}]

import Anthale from "anthale"

const client = new Anthale({ apiKey: process.env.ANTHALE_API_KEY })
const MEMORY_WRITE_POLICY_ID = process.env.ANTHALE_MEMORY_WRITE_POLICY_ID!
const MEMORY_REPLAY_POLICY_ID = process.env.ANTHALE_MEMORY_REPLAY_POLICY_ID!

type MemoryEntry = {
  content: string
  memory_kind: string
  source_type: string
}

export async function sanitizeMemoryWrite(entry: MemoryEntry): Promise<MemoryEntry | null> {
  const response = await client.organizations.policies.enforce(MEMORY_WRITE_POLICY_ID, {
    direction: "input",
    messages: [{ role: "user", content: entry.content }],
    metadata: {
      boundary: "memory_write",
      feature: "support-agent",
      sourceType: entry.source_type,
      memoryKind: entry.memory_kind,
    },
  })

  if (response.action === "block") {
    return null
  }

  const safeContent = response.action === "redact" ? response.redacted_messages[0].content : entry.content
  return { ...entry, content: safeContent }
}

export async function buildMemoryContext(
  memoryEntries: MemoryEntry[],
): Promise<Array<{ role: "system"; content: string }>> {
  const safeContext: string[] = []

  for (const entry of memoryEntries) {
    const response = await client.organizations.policies.enforce(MEMORY_REPLAY_POLICY_ID, {
      direction: "input",
      messages: [{ role: "user", content: entry.content }],
      metadata: {
        boundary: "memory_replay",
        feature: "support-agent",
        sourceType: entry.source_type,
        memoryKind: entry.memory_kind,
      },
    })

    if (response.action === "block") {
      continue
    }

    const safeMessages = response.action === "redact" ? response.redacted_messages : [{ content: entry.content }]
    safeContext.push(safeMessages[0].content)
  }

  return [{ role: "system", content: `Saved memory:\n${safeContext.join("\n")}` }]
}

This keeps Anthale on both sides of the memory lifecycle: before the application saves the content and again before the workflow replays it into model context.

Common failure patterns

A summary job copies user or tool text into memory without trust tagging.
Long-term memory is replayed as if it were system instruction.
Sensitive data is retained longer than the workflow requires.
Teams protect the first request but not the later replay of stored state.

Next steps

Continue with Log Security Events or Data Leakage Prevention.

Documentation

Quick Start

Learn

AI Memory Security Guide

Assumptions

Secure the memory layer

What this looks like in code

Common failure patterns

Next steps

​Assumptions

​Secure the memory layer

​What this looks like in code

​Common failure patterns

​Related deep dives

​Next steps

Assumptions

Secure the memory layer

What this looks like in code

Common failure patterns

Related deep dives

Next steps