AI Security Maturity Model·AWS v1.0.0

Drag to explore · pinch to zoom
Home / Matrix / Capability 5 / c5.3
Foundational AI Application SecurityDefense-in-depth layer: AI Application Capability 5 · Generative AI agentsUse case: AI that acts 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c5.3 Prevent agent memory poisoning

Stop attackers from corrupting an agent's persistent memory to influence its future behavior, by protecting session identifiers and validating what is written to memory.

Foundational
Enhanced
Advanced
Effort: Medium Impact: High GenAI scopesFrom the AWS Generative AI Security Scoping Matrix.: 3 · Pre-trained models; 4 · Fine-tuned models Agentic security dimensionsFrom the AWS Agentic AI Security Scoping Matrix.: Memory & state, Operational boundaries

Implementation guidance

How to implement on AWS

Ensure users cannot modify their session ID or actor ID, and never place ActorID/SessionID in system prompts where they could be manipulated. Add input validation (e.g. a pre-processing Lambda) that rejects attempts to inject false information intended to corrupt agent memory.

Acceptance criteria

Session/actor IDs are server-controlled and absent from prompts; memory writes are validated; a memory-poisoning attempt is rejected.

Practical implementation

How this control is implemented in each reference architecture:

Session/actor IDs are set server-side (never in prompts) and a validation layer rejects attempts to write false information into the agent's memory in the Generative AI account.

  1. Ensure users cannot modify their session ID or actor ID; set them server-side and never place ActorID/SessionID in system prompts where they could be manipulated.
    Application account → Generative AI account AgentCore Memory AWS Lambda
  2. Add a pre-processing Lambda that validates memory writes and rejects attempts to inject false information intended to corrupt agent memory.
    Generative AI account AWS Lambda
  3. Alarm on repeated rejected memory writes as a poisoning signal.
    Generative AI account CloudWatch

How to validate: Session/actor IDs are server-controlled and absent from prompts; memory writes are validated; a memory-poisoning attempt is rejected.

Avoid: Trusting the model or client to supply the actor/session ID. That lets a user reach another's memory; control identifiers server-side.

Generative AI OU (multi-account) →

Server-controlled session/actor IDs and a validation layer on memory writes prevent poisoning within the account.

  1. Set session/actor IDs server-side and keep them out of system prompts.
    Application tier (IAM role) AgentCore Memory AWS Lambda
  2. Validate memory writes with a pre-processing Lambda that rejects false-information injection.
    Generative AI tier (IAM role) AWS Lambda
  3. Alarm on repeated rejected writes.
    In-account logging CloudWatch

How to validate: Session/actor IDs are server-controlled and absent from prompts; memory writes are validated; a poisoning attempt is rejected.

Avoid: Writing to agent memory without validation. A poisoned memory taints every future session; validate what is stored.

Single account (entry point) →

Threats addressed

  • Memory poisoning: injecting false information that taints future sessions.
  • Users manipulating their session/actor ID to reach other data.

AWS services

Amazon Bedrock AgentCore Memory AWS Lambda

Framework mappings

OWASP GenAI/LLM Top 10 (2026)

  • LLM01 Prompt Injection
  • LLM05 Data and Model Poisoning

NIST AI Risk Management Framework (AI 100-1)

  • MANAGE.1 AI risks are prioritized, responded to and managed

AWS Well-Architected Generative AI Lens (Security)

  • GENSEC06-BP01 Implement data purification filters for model training workflows
  • GENSEC05-BP01 Implement least privilege and permission boundaries for agentic workflows

OWASP GenAI Top 10 for Agentic Applications (2025)

  • ASI06 Memory and Context Poisoning

Watch

AWS video: an introduction to Amazon Bedrock AgentCore Memory — how persistent agent memory is organized and managed, which is the foundation for protecting it against poisoning and cross-user leakage.

Learning resources

References

  • AWS SRA for AI — Capability 5, Data protection