Repository navigation
Python: feat(memory): add OWASP Agent Memory Guard for memory poisoning defense (#14006) - #14608
Open
SparkyPunk (sparkysolutions10-pixel) wants to merge 4 commits into
Conversation
…se (microsoft#14006) Signed-off-by: sparkysolutions10-pixelmy <sparkysolutions10@gmail.com>
…icrosoft#14006) Signed-off-by: sparkysolutions10-pixelmy <sparkysolutions10@gmail.com>
… init (microsoft#14006) Signed-off-by: sparkysolutions10-pixelmy <sparkysolutions10@gmail.com>
…14006) Signed-off-by: sparkysolutions10-pixelmy <sparkysolutions10@gmail.com>
SparkyPunk (sparkysolutions10-pixel)
requested a review
from a team
as a code owner
October 16, 2026 07:14
SparkyPunk (sparkysolutions10-pixel)
deployed
to
github-app-auth
October 16, 2026 07:14 — with 
GitHub Actions
Active
GitHub Actions
Active
SparkyPunk (sparkysolutions10-pixel)
deployed
to
github-app-auth
October 16, 2026 07:14 — with
GitHub Actions
Active
GitHub Actions
Active
semantic-kernel-automation
Bot
added
the
python
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
A syntax error breaks memory imports, and unscanned descriptions and metadata allow poisoning payloads through both write paths.
2 open findings
What changed in this PR
Adds opt-in memory-poisoning checks to Python’s SemanticTextMemory, addressing the security concern in #14006.
Changes:
- Introduces extensible guards and regex-based injection detection.
- Adds pre-write scanning to information and reference saves.
- Exports guard APIs and adds detection and write tests.
| File | Description |
|---|---|
| python/tests/unit/connectors/memory/test_memory_guard.py | Tests detection and guarded writes. |
| python/semantic_kernel/memory/semantic_text_memory.py | Adds optional pre-write guard checks. |
| python/semantic_kernel/memory/memory_guard.py | Defines guards, scan results, and rejection errors. |
| python/semantic_kernel/memory/__init__.py | Exports the guard APIs. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+93
to
+94
| r"(?:^| | ||
| )\s*(?:system|developer|admin)\s*:\s*", |
| MemoryPoisoningError: If the memory guard detects a poisoning attempt (OWASP ASI06). | ||
| """ | ||
| if self._memory_guard is not None: | ||
| scan_res = self._memory_guard.scan_write(text=text, collection=collection, id=id) |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem & Solution Overview
Fixes #14006
Problem Description
Semantic Kernel memory connectors (
VolatileMemoryStore,AzureAISearch,Redis, etc.) index external and agent-generated text directly into vector memory without validation or security gatekeeping. When processing untrusted user input or scraped web documents, malicious actors can perform Memory Poisoning (OWASP ASI06 / LLM04) attacks:Solution Summary
This pull request introduces native OWASP Agent Memory Guard integration for Semantic Kernel Python:
MemoryGuardBase&DefaultMemoryGuard: Added insemantic_kernel.memory.memory_guard. Provides extensible memory scanning to detect prompt injection, system instruction overrides (Ignore previous instructions), and delimiter hijacking before embedding generation.SemanticTextMemoryIntegration:memory_guard: MemoryGuardBase | None = Noneparameter.save_information()andsave_reference()execute pre-write security scanning.MemoryPoisoningErrorif a poisoning attempt is detected, stopping malicious payloads before they reach storage.memory_guard=Noneensures zero breaking changes or performance overhead for existing applications.tests/unit/connectors/memory/test_memory_guard.pyverifying detection of prompt injections, blocking poisoned writes, and allowing legitimate clean records.Verification & Testing
Signed-off-by)