AWS Shows AgentCore Memory Protection Pattern Against Memory Poisoning
AWS has published a reference architecture and sample code for multilayer write validation in Amazon Bedrock AgentCore Memory. The solution is intended to detect suspicious content before it is stored in an agent’s persistent memory.
AWS AgentCore Memory protection is a new reference design that AWS published on November 9 along with sample code. The design adds validation before writing to Amazon Bedrock AgentCore Memory to reduce the risk of memory poisoning—storing a malicious instruction that could influence future AI agent sessions.
This is not a fix for a disclosed vulnerability or a response to confirmed active exploitation of the Amazon Bedrock AgentCore service. AWS presents the solution as a demonstration and educational pattern that requires additional security testing before production use.
AWS AgentCore Memory protection before writing
The architecture uses an AWS Lambda interceptor placed before writes to AgentCore Memory through AgentCore Gateway. Content intended for storage is evaluated first and may proceed to the agent’s memory only afterward.
The validation combines four types of signals:
- semantic drift analysis,
- instruction-pattern detection,
- namespace-boundary checks,
- write-frequency anomaly detection.
Based on the evaluation, the system selects one of three decisions: ALLOW to permit the write, QUARANTINE to isolate the suspicious record, or DENY to reject it. Isolation can prevent disputed content from immediately becoming part of the memory available during later interactions.
Why memory validation matters
AgentCore Memory supports both short-term and long-term memory, including retaining knowledge across sessions. With persistent or shared memory, the impact of indirect prompt injection therefore may not remain limited to a single conversation. If malicious content is stored as a memory record, it may appear in the context of the agent’s future responses.
The proposed validation creates a checkpoint before content is stored. For operators of agents with persistent memory, it is a practical defensive pattern, not a finished universal protection. Deployment will require custom testing, threshold adjustments, and validation of behavior for the specific workload.
Public code, but not directly for production
AWS has made a public repository available containing source code, infrastructure defined using AWS CDK, Cedar policies, and test data. The repository explicitly warns that it is demonstration and educational material and is not intended for production use without additional security testing.
AWS reports the expected decision in all 11 of its own test scenarios. However, this result does not constitute independent validation of effectiveness beyond the small test set or evidence of general resilience against prompt injection or memory poisoning. The fact sheet does not provide independent validation of the false-positive rate or ways to bypass semantic detection.
A practical limitation of the design is direct writes through the SDK, which may bypass the Gateway interceptor. Organizations must therefore include protection in flows that do not use AgentCore Gateway. The impact on latency and costs will depend on the region, configuration, and nature of the workload.
What to watch next
It will be important to see whether AWS turns this pattern into a native AgentCore Memory feature. Independent tests of detection accuracy, false positives, and resistance to bypassing will also be relevant. For teams using persistent memory, it is likewise important whether the protective controls will cover direct SDK calls outside AgentCore Gateway.
Sources
- AWS Security Blog – Confirms the publication date, proposed architecture, four signals, ALLOW/QUARANTINE/DENY decisions, internal tests, and solution limitations.
- AWS Samples GitHub repository – Confirms the availability of sample code, project components, and the warning that the code is demonstrational and requires additional security testing before production use.
- Amazon Bedrock AgentCore Documentation – Confirms that AgentCore Memory provides short-term and long-term memory, including retaining knowledge across sessions.
Verified and updated: 11/10/2026 06:27
