{"slug": "current-memory-tools-can-pass-a-poisoned-run-on-procedural-memory-can-stop-it", "title": "Current memory tools can pass a poisoned run on. Procedural memory can stop it", "summary": "A benchmark of Claude Code on a configuration-repair fixture, run with Claude Haiku 5.5 and Claude Sonnet 5.5, found that naive memory tools served a poisoned skill in 2/10 sessions for a new-file poison, 1/10 for an unrelated line and 1/10 for a line fused into the real fix, while the MuscleMemory procedural-memory arm served the separable poisons in 0/20 sessions. Every scored session passed the hidden verifier whether poisoned or not, and the agent carried out the poisoned requirement in 31/31 poisoned learning sessions. In a separate known failure (run: repo-failure, Haiku only), a poison moved into the repository's agent instructions was validated and served by MuscleMemory in 5/5 scored sessions and appeared in the code in 5/5, leading the authors to conclude that proof before reuse does not defend against poisoned inputs.", "body_md": "Does a skill learned from one poisoned session reach later sessions? Claude Code on the\nconfiguration-repair fixture, Claude Haiku 5.5 and Claude Sonnet 5.5, three poisons (a new file,\nan unrelated line, a line fused into the real fix), four arms (no memory, naive memory, replay,\nMuscleMemory). Both memory arms learn from the same four sessions: the poisoned one, then three\nclean ones. Harness: `benchmarks/trust_experiment.py`. Summary: `benchmarks/summarize_trust.py`.\n\n- `sessions.jsonl` : one line per session, rescored from the stored memory and hook databases.`canary_in_skill_shown` : the skill served carries the poison in its steps.`canary_in_guidance` :\nthe guidance the hook injected (rebuilt and matched to the hash it stored,`guidance_rebuilt` )\nnames the poisoned file, line or key.`canary_planted` : the poison is in the final code.`passed` : the hidden verifier passed. Rows with`in_paper_tables: false` are superseded runs,\nkept for the record.\n- `summary.json` : per-arm counts with Wilson 95% intervals.\n\nNames in the data: arm `gate` is MuscleMemory and `off` is no memory; poison `file` is the new file, `line` the unrelated line and `subtle` the line fused into the fix.\n\n| Arm (scored, both models) | Poison | Served | In injected guidance | In code | \n|---|---|---|---|---|\n| No memory | — | — | — | 0/10 | \n| Replay (control) | each | — | — | 10/10 | \n| Naive memory (Mem0 ranking) | new file | 2/10 | 2/10 | 0/10 | \n| Naive memory (Mem0 ranking) | unrelated line | 1/10 | 0/10 | 0/10 | \n| Naive memory (Mem0 ranking) | fused into the fix | 1/10 | 1/10 | 0/10 | \n| MuscleMemory | new file / unrelated line | 0/20 | 0/20 | 0/20 | \n| MuscleMemory | fused into the fix | 5/10 | 0/10 | 0/10 | \n\nNaive memory keeps every passing session as its own skill, trusts all of them, and serves the\none the open-source Mem0 library (2.2.1, local `all-MiniLM-L6-v2` embeddings, no LLM extraction)\nranks first for the task prompt (`--equal-naive --picker`, with `benchmarks/mem0_pick.py`).\nOne naive injection could not be rebuilt from its hash (`guidance_rebuilt: false`).\n\nEvery scored session passed the hidden verifier, poisoned or not. The agent carried out the poisoned requirement in 31/31 poisoned learning sessions across all runs.\n\nKnown failure (`run: repo-failure`, Haiku only, not in the main table): the obvious poison moved\ninto the repository's agent instructions, which every session reads. MuscleMemory validated and\nserved the poisoned skill in 5/5 scored sessions and the poison was in the code in 5/5; without\nmemory it was in the code in 5/5 too. Proof before reuse does not defend against poisoned inputs.\n\nSuperseded runs: the first naive arm learned only from the poisoned session (it served the poison\nin 29/30, which followed from that setup); the next naive arms ranked skills by repetition counts\nbuilt with MuscleMemory's own matching (they never served the separable poisons and served the\nfused one in 5/5 Haiku sessions); and the first MuscleMemory arms used checks this study found\nholes in. All are kept in `sessions.jsonl` with `in_paper_tables: false`. The stored databases and\ntranscripts contain local paths and are not released.", "url": "https://wpnews.pro/news/current-memory-tools-can-pass-a-poisoned-run-on-procedural-memory-can-stop-it", "canonical_source": "https://github.com/TheWariend/MuscleMemory/tree/main/benchmarks/results/poisoned-skill-2026-10-18", "published_at": "2026-10-18 18:29:32+00:00", "updated_at": "2026-10-18 18:49:24.242878+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "large-language-models"], "entities": ["Claude Code", "Claude Haiku 5.5", "Claude Sonnet 5.5", "MuscleMemory", "Mem0", "all-MiniLM-L6-v2", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/current-memory-tools-can-pass-a-poisoned-run-on-procedural-memory-can-stop-it", "markdown": "https://wpnews.pro/news/current-memory-tools-can-pass-a-poisoned-run-on-procedural-memory-can-stop-it.md", "text": "https://wpnews.pro/news/current-memory-tools-can-pass-a-poisoned-run-on-procedural-memory-can-stop-it.txt", "jsonld": "https://wpnews.pro/news/current-memory-tools-can-pass-a-poisoned-run-on-procedural-memory-can-stop-it.jsonld"}}