Open standard · AI security

Safer Agent Memory: stop prompt injection from becoming permanent

By Lesith Dissanayaka (Final Frontier Ventures) and Claude (Anthropic) · 27 October 2026

AI agents are starting to remember. They keep notes between sessions, learn a codebase’s quirks, and carry lessons from one customer engagement to the next. That makes them better, and it also gives every prompt injection a place to live.

The Safer Agent Memory Standard (SAMS) is our answer: a short open standard, a zero-dependency Python reference implementation, a conformance test suite and a Claude Code plugin that applies it to your project. It treats agent memory as an attack surface: memory is scoped, every write is traced, content from untrusted sources is marked, and nothing reaches curated memory without a human approving exactly what they reviewed.

• Repository github.com/Final-Frontier-Ventures/safer-agent-memory
• Package pypi.org/project/safer-agent-memory (pip install safer-agent-memory)
• Status v0.1.0, alpha. Code under Apache-2.0, standard text under CC BY 4.0.

Why we built it

Memory makes prompt injection persistent. Without memory, a poisoned web page, scan result or email can mislead one session. With memory, the agent may write that poison down as a “lesson”, and every future session reads it as trusted guidance. A one-off injection becomes a standing instruction.

For us this is not a hypothetical. At Final Frontier Ventures we build security products such as AttackSight, an AI attack surface management platform, and work on automated penetration testing. Those agents read attacker-controlled content all day: HTTP responses, banners, crawled pages, OSINT and dark web data. They also work for many clients, whose data must never mix.

The field has moved quickly on context engineering. Anthropic has described the progression publicly: CLAUDE.md files, in-session memory tools, skills that load on demand, and memory modelled as a file system the agent searches. It has also described the production guardrails memory needs (versioning, concurrency control, permissions, portability) and “dreaming”, an out-of-band job that reviews many sessions and proposes memory changes for a human to accept.

Most open-source agent memory projects focus on recall: storing memories and finding the right one. Far fewer focus on governance: who may write what, where it came from, whether it can be trusted, and how a person stays in control. SAMS takes those ideas and adds the security controls we needed when agents handle untrusted input and multiple tenants.

What it does

SAMS rests on one rule: agents write freely only to their own scratchpad; everything else is promoted by a person who sees exactly what they approve.

On top of the scopes, SAMS adds five controls:

• Taint tracking. When a session reads content an outsider can control, the harness marks it. The agent cannot clear the mark, and the review step sees it.
• Tenant isolation. A session holds one tenant at a time, and storage keeps tenants physically apart, so one client’s data cannot leak into another’s memory.
• Provenance and versioning. Every change records who made it, from which session, and can be rolled back in one step. Concurrent writers get a conflict instead of silently overwriting each other.
• Review integrity. The owner promotes exactly the version they reviewed. If an agent edits a pending entry after review, acceptance fails.
• Dreaming with a gate. A scheduled job reads many sessions, spots repeated corrections and stale entries, and proposes changes with evidence. Proposals are redacted and flagged when they touch commands, URLs, credentials, scope or permissions. The job can propose; it can never write.

SAMS also keeps facts and lessons apart. Domain facts stay in your database; memory holds how to work, such as “this tool returns noise for this input” or “run migrations before seeding”.

How it works

Every path into curated memory passes through one human decision.

Agents keep working notes in their scratchpad and queue anything lasting as a pending write. A scheduled dreaming job reads the scratchpads, pending writes and session transcripts for one scope, and turns repeated patterns into proposals. The owner accepts or rejects each one, and accepted changes load into the next session as labelled reference data, never as instructions.

How to use it

There are three ways in, depending on how much you want to build.

1. Let your coding agent apply it

SAMS was written so an AI coding agent can read it and build the right system for your project. Install the repository as a Claude Code plugin, or copy STANDARD.md and skills/adopt-memory into your repo, then run:

/adopt-memory

The skill inspects the project and writes a memory profile. It then asks you the decisions it must not make alone: what counts as a tenant, which inputs are untrusted, and how long memory is kept. Only then does it build the tier the project needs and prove it with the conformance tests. Not using Claude Code? Give STANDARD.md to any coding agent and ask it to follow section 0.

2. Use the library

pip install safer-agent-memory

from sams import SQLiteBackend, AgentSession

backend = SQLiteBackend("memory", read_only=["org"])
session = AgentSession(backend, session_id="s-001", agent="recon-agent",
                       assigned="tenant:acme")

# Calling it taints the session
fetch = session.tainting(my_http_fetch, reason="web_fetch")
# The only memory tools the model sees
tools, schemas = session.tools(), session.tool_schemas()
# Memory as labelled data, not instructions
context = session.context_block()

The owner reviews pending writes and dreaming proposals from the command line:

sams pending list --base memory --scope tenant:acme
sams pending show --base memory --scope tenant:acme waf.md s-001
sams review list  --base memory --scope tenant:acme

The library has no dependencies beyond Python’s standard library. Agents running on one host get tenant isolation from one SQLite directory per scope and read-only Docker mounts; a Postgres backend with row-level security is planned for multi-host deployments.

3. Just your coding sessions

If your only agent is your coding assistant, copy templates/claude-code/ into the repo. You get a lean CLAUDE.md, deny rules on curated files, a notes/ scratchpad, and a weekly job that proposes memory changes on a dream/<date> branch for you to review like any pull request.

How we know it works

A security standard is only as good as what you can check, so every rule in SAMS comes with a test.

• Conformance suite. Twelve requirements, C1 to C12, written as backend-agnostic tests. They check that agents cannot write shared memory, cannot cross tenants, cannot set their own provenance or clear taint, and cannot change a pending entry after the owner has reviewed it. Plug in your own backend and run pytest.
• Adversarial review before release. Before publishing, we had an independent reviewer try to break the reference implementation. It found real problems, including a way for an agent to swap a pending entry between the owner’s review and approval. Each was fixed and now has a regression test; that particular one became requirement C12.
• CI on every change. The suite runs on Python 3.10 to 3.14, on Linux and macOS, for every push and pull request.
• Trusted publishing. Releases are built in GitHub Actions and uploaded to PyPI through OpenID Connect, with no long-lived API token. A release cannot publish unless the full test matrix passes and the tag matches the package version.

In total the first release ships with 49 tests.

What it does not do, and what’s next

SAMS reduces risk; it does not remove it. We would rather say so plainly:

• Redaction and flagging are safety nets. They are pattern-based, so a determined attacker can phrase around them. The human review gate is the real control, which is why it is enforced in code rather than left to good intentions.
• The harness must be honest. Taint tracking only works if every untrusted source is wrapped. SAMS makes that explicit in each project’s memory profile, but it cannot find a source you forgot to list.
• Coding-assistant deny rules are partial. They block the assistant’s edit tools and common shell edits, not every possible write. For stronger guarantees, make curated files read-only on disk or require review of every commit that touches them.
• It is an alpha. The rules are stable enough to use; names and APIs may change before 1.0.

Roadmap

• v0.2: a Postgres and Supabase backend with row-level security, an MCP server that exposes the four memory tools to any agent, and Postgres in the conformance matrix.
• v0.3: a TypeScript port of the harness and adapters for common agent frameworks.
• Ongoing: applying SAMS to our own products, starting with AttackSight, and publishing what we learn.

Credits

SAMS stands on ideas others shared openly.

• Anthropic’s context engineering work. The memory model in SAMS (markdown memory as a file system, progressive disclosure, versioning, concurrency control, permission tiers, portability, and out-of-band “dreaming” with human review) follows the approach presented by Lamis of Anthropic’s Applied AI team in a talk at AI Devcon, and the memory and dreaming features Anthropic has built into Claude Managed Agents. SAMS adds taint tracking, tenant isolation, review integrity and a conformance suite on top, for agents that handle untrusted input.
• The open-source and security communities whose work on prompt injection, least privilege and supply-chain security shaped the controls here.

SAMS is an independent project. It is not affiliated with or endorsed by Anthropic.

About the authors

Lesith Dissanayaka is the founder and director of Final Frontier Ventures, where he builds AI security products including AttackSight. He works across penetration testing, ISO 27001 and 27701 implementation, and AI security.

Claude is an AI model made by Anthropic. SAMS was designed in a working session between the two: Lesith set the direction, the security requirements and the product context, and reviewed every decision; Claude drafted the standard, wrote the reference implementation and tests, and ran the adversarial review that hardened it before release.

Get involved

• Try it and tell us what was awkward: github.com/Final-Frontier-Ventures/safer-agent-memory
• Report a bypass privately, as described in SECURITY.md. Ways around the rules are the most valuable thing you can send us.
• Contribute a backend. Implement the backend interface, add it to the conformance suite and open a pull request.

Code is licensed under Apache-2.0. The standard text, templates and documentation are licensed under CC BY 4.0. © 2026 Final Frontier Ventures (Pvt) Ltd.