cd /news/ai-agents/what-i-learned-auditing-an-open-sour… · home topics ai-agents article
[ARTICLE · art-138736] src=dev.to ↗ pub= topic=ai-agents verified=true sentiment=↑ positive

What I learned auditing an open-source AI-memory SDK (and the bug I found in it)

A developer auditing the open-source MemWal (Walrus Memory) SDK, which provides persistent cross-session memory for AI agents, found an authorization bug in a sample chatbot app's vote endpoint: the existence check was scoped only by messageId while the update was scoped by messageId and chatId, letting any logged-in user silently block another user's vote on a public message with a 200 response and no error. The maintainers confirmed and shipped a fix within days by scoping the existence check the same way as the update, and the developer also found a sibling login-flow app missing an on-chain verification step its near-identical twin performed.

by read3 min views1 publishedSep 24, 2026

Most chatbots forget everything the moment a conversation ends. I spent

a few days digging into an open-source project (MemWal / Walrus Memory)

that tries to fix that — persistent, cross-session memory for AI agents

— and ended up doing a full security review of the codebase along the

way. Here's what actually stood out.

## The interesting part wasn't the AI

Everyone talks about embeddings and semantic recall when they talk about

"AI memory." The part that actually breaks in production is much more

boring: ownership checks.

Any system where User A's data must never leak into User B's session

lives or dies on a handful of WHERE user_id = ? clauses. Get one of

them wrong, and no amount of good embedding quality saves you.

## The bug

While reviewing a sample chatbot app built on this SDK, I found a vote endpoint with a subtle but real bug:

messageId. UPDATE was scoped by messageId AND chatId. Any user who could see a message in a public chat (message IDs are

rendered right in the UI) could submit a vote using their own chat

ID but a stranger's message ID. Since no vote existed yet for that

message, it silently inserted a mismatched row.

The nasty part: the next time the actual message owner tried to vote

on their own message, the lookup found the attacker's row (again,

scoped only by messageId), the UPDATE matched zero rows because the

chatId didn't match, and the API returned 200 "Message voted"

while silently doing nothing. The real owner could never vote on that message again, and had no way of knowing why.

Zero errors thrown. Zero logs. Just a permanently broken feature for

one specific user, triggered by any other logged-in user.

I filed it, the maintainers confirmed and shipped a fix within days:

scope the existence check the same way as the update.

## The bigger lesson

The core SDK, the auth layer, the on-chain contract — all of it was

extremely well hardened. Constant-time comparisons, quarantine states,

counter-based replay protection, the works. The bug wasn't in any of

that. It was in a sample app that gets far less scrutiny than the

"real" infrastructure around it.

If you're reviewing (or building) a system like this, the example apps and demos are usually where the actual bugs hide — not the core library

everyone stares at.

**## A second, quieter finding ** I also found a spot where one sibling app (a login flow) had an on-chain verification step that its near-identical twin app was missing entirely — same function available in the codebase, just never called on one specific path. Lower severity (the affected app is explicitly demo-only and the riskiest downstream action was already disabled), but the same underlying lesson: when you fix a security issue in one place, check every place that duplicates that logic.

If you're building anything with persistent memory/state across sessions for an AI agent, happy to talk through what to watch for.

This was part of a hackathon bug-bounty track, but the lessons apply

to basically any multi-tenant app.

If any of this sounds interesting, Walrus Sessions 8: "Chatbots That Remember" is a live hackathon session running Sept 18 – Oct 9, 2026,

with $2,500 in WAL prizes. The challenge: build (or retrofit) a

chatbot that uses Walrus Memory to remember context across sessions,

users, and devices — any use case counts (support, onboarding, tutoring,

game NPCs, community bots).

There's also a standalone Bug Bounty track (5 × $100) if finding

bugs like the one above is more your thing than building a full chatbot

— no chatbot required, just a reproducible bug filed on GitHub.

── more in #ai-agents 4 stories · sorted by recency
── more on @memwal 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/what-i-learned-audit…] indexed:0 read:3min 2026-09-24 ·