Agent memory becomes both the performance lever and the attack surface

No funded company yet sells a dedicated, enterprise-grade product for authority-labelled agent memory or for memory incident forensics. The pieces exist as open-source projects (OWASP Agent Memory Guard, Memward, ShieldCortex, Memoria, agmem), as research (MemLineage, origin-bound authority papers), and as side features inside memory vendors (Zep, Mem0) and agent-security platforms (Lasso). The opening is in three places. First, enforcement based on authority rather than content: most current tools scan content with detectors, which research says is easy to game, while recording each memory's source and what it may authorise, and refusing to let low-authority memories trigger risky tool calls even after laundering through summaries, is mostly unshipped. Second, a forensics console for security teams rather than developers: tracing which memory caused which action, finding when an injection entered, and rolling back every summary and index copy it spread into, since research shows deletion often leaves those copies behind. Third, one layer that works across Mem0, Zep, Letta and LangGraph, exports to SIEM tools and reports against OWASP ASI06. The risks are that OWASP's free project already covers basic screening and snapshots, memory vendors could add source labels to their own stores, and agent-security platforms such as Lasso, Zenity or Palo Alto could bundle memory protection. The window looks like 12 to 24 months, and combining prevention with forensics is a stronger pitch than either idea alone.

• OWASP Agent Memory Guard

  Open-source Apache-2.0 runtime layer between agent and memory store. It runs detector pipelines with allow, redact, quarantine or block policies, SHA-256 tamper baselines, and point-in-time snapshots for rollback. It is free and overlaps both ideas at a basic level, but it judges content with detectors rather than tracking authority.

• Memward

  Alpha v0.1 Python package that wraps Mem0 or LangGraph memory with source labels and trust levels and keeps low-trust memories out of tool-calling decisions. It is the closest to the Memory Firewall idea but experimental, and its protection depends on honest source labels.

• ShieldCortex

  Open-source multi-layer memory firewall that scans incoming memories for hidden instructions, command injection and encoded payloads. It filters on content rather than enforcing authority by source.

• Memoria (MatrixOrigin)

  Git-like snapshot, branch, merge and point-in-time rollback for agent memory on MatrixOne copy-on-write storage. It claims an audit trail with a source chain for each change and quarantine of low-confidence memories. It overlaps strongly with Audit and Rollback but is aimed at developers, not security teams.

• agmem

  Version control for agent memory with commits, branches, merges and rollback. Developer tooling with no security or injection-forensics focus.

• GitAgent

  Stores agent memory as Markdown in a Git repo with a commit on every write, using git log, diff and revert for audit and rollback. A minimal do-it-yourself substitute for the rollback idea.

• Lasso Security MCP Gateway

  Agent-security vendor whose gateway plugin claims to stop memory poisoning through session memory isolation, source validation and rollback from forensic memory snapshots. Shows that security platforms are bundling memory protection as a feature.

• Zep

  Memory vendor with time-stamped facts carrying source records, ABAC, retention controls and SOC 2 Type II. Its audit logs cover only dashboard user actions, not what agents read or write through the API or SDK, which leaves a gap for memory forensics.

• Mem0

  Leading memory layer marketing compliance features: memory scoped by user, agent and app, BYOK, air-gapped deployment, SOC 2 Type I. No documented source-based authority enforcement or injection rollback found, but it is well placed to add them.

• MemLineage (research)

  May 2026 research design that signs each memory entry and keeps a derivation graph, blocking sensitive actions whose justification traces back to external sources. Close to the authority-labelling idea but not productised.

• Nous (hackathon project)

  July 2026 hackathon demo of trust-partitioned memory that caps a memory's trust at the lower of its source tier and its content confidence, including demos of attacks laundered through trusted tools. Prototype only.

Checked 2026-10-21