Agent Memory Guard: Prevent memory poisoning in Semantic Kernel agents (OWASP project)

[vgudur-dev]

What I built

Agent Memory Guard — an open-source Python middleware that screens memory reads/writes in AI agent systems for injection attacks, data poisoning, and exfiltration.

Why Semantic Kernel users should care

If you use Semantic Kernel's chat history, memory connectors, or the new Agent framework with persistent state, your agents are vulnerable to memory poisoning — classified as OWASP ASI-06.

Attack scenario:

1. Attacker crafts input with an encoded injection payload
2. Your agent stores it in chat history or semantic memory
3. On next retrieval, the poisoned memory enters the agent's context window
4. Agent follows attacker's instructions instead of the user's

Integration example (Python SDK)

pip install agent-memory-guard

from semantic_kernel import Kernel
from semantic_kernel.agents import ChatCompletionAgent
from agent_memory_guard import MemoryGuard

guard = MemoryGuard()

# Screen user input before adding to chat history
async def secure_chat(agent, user_input):
    scan = guard.scan(user_input)
    if not scan.is_safe:
        return f"Blocked: {scan.threat_type} (confidence: {scan.confidence})"
    
    # Safe to proceed with the agent
    response = await agent.invoke(user_input)
    return response

# Also screen memory retrievals
async def secure_memory_recall(memory_store, query):
    results = await memory_store.search(query)
    safe_results = []
    for result in results:
        scan = guard.scan(result.text)
        if scan.is_safe:
            safe_results.append(result)
        else:
            logger.warning(f"Poisoned memory blocked: {scan.threat_type}")
    return safe_results

Key features

• 5 detection layers: heuristic patterns, embedding similarity, entropy analysis, encoding detection, LLM-as-judge
• 59μs median latency — adds no noticeable overhead
• Framework agnostic — works with Semantic Kernel, LangChain, LlamaIndex, CrewAI, AutoGen
• OWASP incubator project — actively maintained

Links

• GitHub: https://github.com/OWASP/www-project-agent-memory-guard
• PyPI: https://pypi.org/project/agent-memory-guard/
• OWASP page: https://owasp.org/www-project-agent-memory-guard/

Would love feedback from the SK community — especially on the best hook points for the .NET SDK integration (middleware pipeline? filter?).