Tool calls and agent memory set the blast radius
An agent can be wrong in two dangerous ways: it can act on the error, then preserve the error for later. Authority sets the immediate impact; retention sets its reach.
By Piotr Zenon Żabrowski · Published · Updated
Map authority and persistence together
An agent's working cycle turns model output into application choices: select a step, request an operation, inspect returned data, and continue. The model supplies proposals; application code decides whether anything happens. That handoff may also turn temporary context into durable state. Blast radius depends on the operation's authority and on the lifetime and audience of information retained from it.
The label "memory" hides several boundaries. Training can leave patterns in model weights, but an agent usually gets continuity from software that reattaches messages, maintains a task record, or retrieves saved notes. A scratchpad can disappear when one job ends; a shared entry can steer other agents and later sessions. Inventory each record by who can write it, who can read it, and when it expires.
| Operating envelope | Failure reach | Primary containment |
|---|---|---|
| Text output with run-scoped context | A wrong answer affects the current exchange | Output review and deletion of task state |
| Read tools with private persistent memory | Untrusted data may influence later work for one user | Per-user access checks, provenance, and expiry |
| Write tools with shared memory | One poisoned record can drive repeated changes across tasks | Independent authorization for actions and memory writes |
| Code or broad APIs with cross-agent state | The failure can cross systems and agent roles | Sandboxing, allowlists, partitions, budgets, and a kill switch |
The escalation path crosses both axes
Tool responses return to the model as input. An email, document, database field, or web page can carry hostile instructions intended to redirect the next decision. If application code then permits a sensitive call, untrusted content has reached a side effect. If the resulting claim or instruction is also saved, the attack gains a second life: later runs may retrieve it without the original suspicious context.
Contain the combined failure
- Authorize every tool call against the current user and task, not the model's confidence.
- Show the exact recipient, record, amount, command, or deletion target before approval.
- Treat retrieved content and tool output as untrusted data, never as authority.
- Partition temporary and persistent state by tenant, user, agent, and process.
- Set size limits, expiry, provenance, review, and deletion paths for durable entries.
- Link logs across the triggering input, tool arguments, result, and resulting memory changes.
Frequently asked questions
Is conversation history the same as persistent memory?
No. History is usually reinserted into the current context. Persistent memory is stored by the application and can influence later processes or sessions.
Should agents share memory?
Only when the task requires it. Shared stores need explicit read and write scopes because a false or hostile entry can influence every agent that retrieves it.
Related
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
Multi-agent teams
Splitting tasks across specialized AI agents multiplies capabilities but creates a broader attack surface. Learn how to secure the protocols connecting them.
Containing compromised agents
An agent will eventually be tricked, mistaken, or hijacked. Five architectural controls decide what it can still do when that happens.
What contains a CLI agent
Four failure modes, the profile that answers them, and why enforcement can't live inside the agent's own instructions.
Seatbelt, container, VM
Which failures each isolation layer contains, five container defaults that delete the boundary, and which kind of VM is a real one.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.