Memory Sweep: find injected instructions and bad rules persisted in agent memory and schedules
A local hook that diffs and scans agent memory files and scheduled tasks between sessions. Developers and small teams pay.
Competitive · Carryover attack benchmark published
Written for: Solo builder
Next step
This week, build the snapshot-diff-approve hook for one harness, including its scheduled tasks, run the carryover benchmark's attack cases through it to show which ones it catches, and post the results to r/LocalLLaMA and the paper's authors.
Why now
Here is what changed since Workspace Sweep. The two persistence channels are now named and benchmarked, a model small enough to run on every session diff has been described, and research shows memory goes bad even without an attacker. The sweep can therefore cover scheduled tasks and memory provenance, not just files in the workspace. It can also flag wrong learned rules as well as malicious ones.
What became possible
A new benchmark shows that a single indirect prompt injection written into an agent's memory files or scheduled tasks keeps firing in later sessions after the attacker is gone. ClawMMU proposes labelling every memory entry with its owner, origin and authority. nokast-secureRAG describes a roughly 0.5B model that classifies query-plus-context pairs as safe, suspicious or malicious. Separate work finds that stored rules and summaries spread an agent's own errors forward.
Three ways in
- memsweep hook
After each session, it snapshots memory files (CLAUDE.md, AGENTS.md, harness memory directories) and scheduled tasks, diffs them against the last approved state, scores new lines with a small local classifier, and blocks the next session until the user approves anything that came from outside.
- Customer
- Developers running Claude Code, Codex or local agents with memory and cron enabled
- Model
- Open-source hook. $8/month team tier with shared approval history
- Memory blame
For each memory line, it records which session, tool call or fetched URL wrote it, so you can trace a strange instruction back to its source.
- Customer
- Same users, plus agent harness authors
- Model
- Part of the team tier
- Rule replay
Re-runs a few saved tasks with and without each learned rule and flags rules that make results worse.
- Customer
- Teams tuning agent memory
- Model
- Usage-priced add-on
Competition
Basic scanning and diffing of CLAUDE.md, AGENTS.md and memory folders is already crowded with free tools: the claude-code-security memory drift hook, AgentShield, Warden, soul-guardian, memory-scan and simple hash checkers. A paid product that only matches patterns or compares fingerprints would struggle against these.
Full competition notes (12 competitors)
Basic scanning and diffing of CLAUDE.md, AGENTS.md and memory folders is already crowded with free tools: the claude-code-security memory drift hook, AgentShield, Warden, soul-guardian, memory-scan and simple hash checkers. A paid product that only matches patterns or compares fingerprints would struggle against these. Several gaps are still open. None of the tools I found covers scheduled tasks or cron jobs. None does a proper flow where new lines must be approved before the next session can start. None works across tools, handling Claude Code, Codex and local agents with one approved baseline. And none records where each memory line came from. Memory blame, meaning which session, tool call or fetched URL wrote a line, is what OWASP's agentic AI Top 10 (ASI06) and recent research recommend under provenance, but I found no product that does it for local agent setups. This is the strongest angle, and harness authors could adopt it as a standard. Rule replay, re-running saved tasks with and without each learned rule, looks empty as a product: I found only papers and loose ablation add-ons for OpenClaw. It is probably a smaller, more eval-focused market. The risks are that the agent makers (Anthropic with auto memory, OpenAI with Codex) could build provenance or memory review into their own tools, and that developers expect free tooling here. A paid tier would probably have to be team policy, a shared approved baseline and audit logs, not the local scanner itself.
- mbay7/claude-code-security
A free (MIT-licensed) security toolkit for Claude Code. One of its hooks checks memory files for injection patterns and reports the file and line. Other parts scan files Claude reads and check that the hooks themselves haven't been changed. This is the closest match to the memsweep hook, but I saw no approval step that blocks the next session and no cover for scheduled tasks.
- AgentShield (ecc-agentshield)
A free scanner, run with one npx command, that grades the ~/.claude folder, CLAUDE.md, hooks and MCP setup for risky instructions and secrets. It checks a snapshot each time it runs; it doesn't track changes between sessions.
- OpenClaw Warden
A community add-on for the OpenClaw agent that watches AGENTS.md, SOUL.md, memory files and installed skills for unauthorized changes after setup.
- soul-guardian (clawsec)
A marketplace add-on from Prompt Security that watches agent identity and memory files such as SOUL.md and AGENTS.md for unauthorized changes.
- OpenClaw memory-scan
Scans MEMORY.md, daily memory logs and workspace files, including AGENTS.md, for prompt injection, leaked credentials and dangerous instructions, and grades findings from low to critical.
- memory-poison-auditor
An OpenClaw add-on that flags injection markers, suspicious claims of authority and hidden policy blocks in memory.
- Prompt Shielder
A simple bash script that records fingerprints (SHA256 hashes) of config files and later compares them to spot changes.
- trace-mcp check-claudemd-drift
A tool, exposed through MCP, that checks for drift in CLAUDE.md.
- Telnyx AGENTS.md injection scanner
A Python scanner that uses an LLM to check AGENTS.md, CLAUDE.md and Cursor rules for hidden prompt injection. It never runs anything from the repository.
- LatticeFlow memory store evaluation
A judge model scans the memory stores of Claude managed agents for injected instructions, credentials and personal data. It covers the hosted memory product, not local files.
- Rubrik Agentic Cyber Resilience for Claude
An enterprise product that backs up, monitors and restores the configuration that governs Claude agents. It covers rollback but isn't aimed at developers or small teams.
- Mem0
A memory platform that keeps memory separate per user and agent and publishes guidance on defending against memory poisoning. That protection only covers its own hosted memory.
Checked 2026-10-21
Risks
- Harness vendors may add provenance natively, as ClawMMU proposes
- The 0.5B classifier's weights and licence may not be available, which would force a fallback to a hosted small model
- Memory formats differ across tools and change often
- Individuals pay little, so the business depends on team adoption
Strong team fit; market pull is the weak point (5).
tech 7 · pull 5 · space 7 · fit 9 · build 8
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- After the Attacker Leaves: Benchmarking Carryover Attacks on LLM AgentsarXiv
- ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM AgentsarXiv
- Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAGarXiv
- More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM AgentsHF Daily Papers
- ALTK-Evolve: How learned memory tops the τ²-bench leaderboard on customer service tasks without a frontier modelHugging Face Blog
Status history
- 2026-10-21 Flagged as buildable