Research Published: Aug 5, 2026

MCFA Turns Agent Memory into a Delayed Control-Flow Input

Memory Control Flow Attacks (MCFA) do not need direct access to an agent's memory database or system prompt. The research shows how ordinary interaction can place an action-oriented preference into long-term memory, then a later benign task retrieves it and changes tool choice or order. Across controlled LangChain and LlamaIndex experiments, tool-selection attacks were highly reliable, while ordering attacks were weaker. Memory must therefore be governed as persistent control input, not trusted conversation history.

Prompt InjectionTool AuthorizationAgentic AI
6 applicable AIDEFEND defenses
Source: From Storage to Steering: Memory Control Flow Attacks on LLM Agents 
Authors: Zhenlin Xu, Xiaogang Zhu, Yu Yao, Minhui Xue & Yiliao Song
Original article: Jun 5, 2026

Threat Analysis

  • The attacker did not need memory-database access. One or a few ordinary interactions caused the agent to store an action-oriented preference. A later benign task retrieved it and changed tool choice or order, while the trusted tools and system prompt remained unchanged.
  • The study measured related but distinct outcomes. Override selected a risky tool and reached 97.2% to 100% success. Order violated a required sequence and reached 52.8% to 69.4%. Cross-task and more-than-30-round tests showed that the effect could persist, while matched benign-memory controls remained at 0%.
  • Simple mitigations were incomplete. Adding 100 benign records did not remove the effect. Summarization reduced malicious-write success, but every summarized instruction that survived still steered the later task. Role-based memory segregation reduced some Override rates, yet residual success ranged from 2.8% to 100%.
  • This was controlled research. The evaluation used synthetic safe and risky tool variants, no production users, and no harmful external actions. It measured tool-trace deviation, not real damage. There is currently no public evidence that MCFA has been used in an actual attack.

Applicable AIDEFEND Defenses (6)

AID-I-004.004
Transactional Promotion Gates (Quarantine -> Trusted)
Very High
Route every untrusted or high-risk new memory record to quarantine, then promote the exact version through an atomic, evidence-backed state transition before it becomes retrieval-eligible. This directly interrupts MCFA's first stage by preventing an ordinary low-trust conversation write from silently becoming trusted control input.
AID-H-018.003
High-Impact Independent Validation & Approval Gate
Very High
At the executor boundary, independently validate the canonical action, caller identity, policy evidence, and exact approval for high-impact operations. Even when malicious memory succeeds in changing the plan or tool order, the recalled text cannot authorize a transfer, deletion, credential change, or other side effect by itself.
AID-I-004.002
Persistent Memory Partitioning (Trust & Tenant Isolation)
High
Partition persistent memory by tenant and trust tier, and make retrieval consult centralized entitlement policy before a record enters the model context. This limits cross-user and low-trust recall, but the paper's RBMS results show that segregation plus prompt hierarchy is not a complete defense when models fail to honor the hierarchy.
AID-D-001.005
Recalled Memory Pre-Rehydration Scanning
Medium
After loading an exact versioned memory record and before adding it to the prompt, rescan it for role or authority assertions, trigger-like markers, encoded fragments, known quarantine fingerprints, and policy risk, then emit a content-bound finding that downstream policy can quarantine or omit. This places inspection at MCFA's second stage, although semantic instructions can evade detection and a finding is not enforcement by itself.
AID-D-003.004
Tool-Call Sequence Anomaly Detection
Medium
Learn approved tool transitions and detect forbidden, low-likelihood, or missing-stage sequences, such as a transfer tool appearing before its required audit step. This is especially relevant to MCFA Order attacks and can surface successful steering, but it detects a changed trace after planning rather than preventing the memory write.
AID-M-002.004
Trust-Tiered Memory/KB Provenance & Write Eligibility Contract
Medium
Record who proposed each memory item, the supporting evidence, validator result, namespace, trust tier, and recommended retrieval eligibility, including contradiction checks against authoritative facts. This creates the decision facts a promotion gate needs; it classifies and preserves provenance but does not enforce admission on its own.

What Defenders Should Do Now

  • Trace every path that can write long-term memory, including direct chat, tool output, summaries, delegated tasks, and imported records. Mark which writes can later influence tool-capable agents.
  • Route low-trust or insufficiently evidenced new memory to quarantine by default. Require version-bound evidence and an explicit promotion decision before a record can enter trusted retrieval.
  • Separate memory by tenant, source, and trust tier, then enforce retrieval eligibility outside the model prompt. Do not rely on text such as “system memories outrank user memories” as the only boundary.
  • Before rehydration, scan the exact recalled record and preserve the result with its version. At execution, independently authorize every high-impact action regardless of what memory recommended.
  • Add regression tests for override, reordered tools, cross-task activation, long-horizon persistence, benign-memory crowding, and model upgrades. Measure both malicious-write admission and downstream unsafe action rates.

Conclusion

MCFA changes the security question from “who can edit the memory database?” to “what content can become future decision authority?” AIDEFEND  maps this case to distinct controls for provenance, quarantine-to-trusted promotion, tenant and trust partitioning, recall-time inspection, sequence monitoring, and final action authorization. The decisive boundary must remain outside the model: a remembered preference may inform planning, but it must never grant permission to act.