Agent Memory Guard: Security middleware to prevent memory poisoning in multi-agent systems (OWASP)

[vgudur-dev]

What I built

Agent Memory Guard — an open-source Python middleware that screens memory reads/writes in AI agent systems for injection attacks, data poisoning, and exfiltration.

Why AG2 users should care

In multi-agent conversations, agents share context and build on each other's outputs. This creates a unique attack surface: if one agent's memory is poisoned, it can cascade to all downstream agents in the group chat.

This is classified as OWASP ASI-06 (Agentic Memory Threats).

Attack scenario in AG2:

1. A user (or compromised external tool) injects a payload into a group chat message
2. The GroupChatManager stores it in the conversation history
3. When other agents retrieve context, the poisoned message enters their prompts
4. Agents follow attacker's instructions — data exfiltration, privilege escalation, etc.

Integration with AG2

pip install agent-memory-guard

from ag2 import ConversableAgent, GroupChat, GroupChatManager
from agent_memory_guard import MemoryGuard

guard = MemoryGuard()

# Add a message filter hook to screen all messages
def secure_message_hook(sender, message, recipient, silent):
    scan = guard.scan(message if isinstance(message, str) else message.get("content", ""))
    if not scan.is_safe:
        return True  # Block the message
    return False

# Apply to your agents
agent = ConversableAgent("assistant", ...)
agent.register_hook("process_message_before_send", secure_message_hook)

Key features

• 5 detection layers: heuristic patterns, embedding similarity, entropy analysis, encoding detection, LLM-as-judge
• 59μs median latency — negligible overhead in multi-agent conversations
• Framework agnostic — works with AG2, LangChain, LlamaIndex, CrewAI, DSPy
• OWASP incubator project — actively maintained

Links

• GitHub: https://github.com/OWASP/www-project-agent-memory-guard
• PyPI: https://pypi.org/project/agent-memory-guard/
• OWASP page: https://owasp.org/www-project-agent-memory-guard/

Would love feedback from the AG2 community — especially on the best hook points for message filtering in group chats.