AWS outlines multilayer defenses against memory poisoning in Bedrock AgentCore
Summary
AWS describes a write-time validation pipeline for Bedrock AgentCore Memory that combines semantic drift, injection patterns, namespace checks, and write-rate signals to allow, quarantine, or deny writes.
Key points
- The proposed pipeline attaches a Lambda interceptor to AgentCore Gateway and scores memory writes using semantic drift, instruction patterns, namespace boundaries, and write-rate anomalies.
- Writes are allowed below a score of 35, quarantined at 35–60, and denied above 60; quarantine and denial can trigger SNS alerts.
- The design combines the interceptor with existing IAM conditions, Cedar policies, memory-strategy prompts, and Amazon Bedrock Guardrails.
- AWS reports expected decisions in all 11 demo scenarios, but the demo used keyword overlap as a local approximation—not Amazon Titan Text Embeddings V2; results may vary.
- The article reports about 26 ms of added warm-path latency in its test environment and notes that direct SDK writes bypassing the gateway need separate validation.
Article Details
- Defense Focus
- Protect persistent AgentCore Memory from write-time poisoning by combining content-aware scoring, namespace isolation, and alerting.
- Detection Methods
- Compare memory-write content with current session context using cosine similarity of Amazon Titan Text Embeddings V2 vectors to identify semantic drift, including non-English or obfuscated content.
- Apply regex pre-filtering for known instruction-injection patterns.
- Check whether the writing session is permitted to write to the target namespace.
- Compare writes per session with a learned baseline to flag anomalous bursts.
- Combine the four signals into a score: ALLOW below 35, QUARANTINE from 35–60, and DENY above 60. The article’s demo results use a keyword-overlap approximation rather than Titan embeddings.
- Data Sources
- Memory-write content and current session context
- Target AgentCore Memory namespace and session write authorization
- DynamoDB write-rate counters and learned per-session baseline
- Audit logs for write activity
- Alert details including agent ID, target namespace, composite score, and content preview
- Rule Types
- Regex-based instruction-pattern rules
- Cedar namespace-isolation policies
- IAM namespace-variable conditions
- Weighted, threshold-based multi-signal scoring
- Defensive Actions
- Attach the validation Lambda as a pre-write interceptor on AgentCore Gateway.
- Allow low-scoring writes, redirect quarantined writes to an isolated namespace, and block high-scoring writes.
- Restrict runtime writes to system/ namespaces; use Cedar policies to enforce namespace-level isolation and quarantine access.
- Send QUARANTINE and DENY notifications to the security team through SNS.
- For high-security environments, set the interceptor failure policy to BLOCK; use ALLOW when availability takes precedence.
- Periodically update regex patterns and tune thresholds for the deployment environment.
- For writes that bypass AgentCore Gateway through direct SDK calls, add validation before create_event or apply IAM namespace conditions and custom consolidation prompts.
Vendors
Products
AgentCore GatewayThe validation pipeline attaches as a pre-write AWS Lambda interceptor on AgentCore Gateway.AgentCore IdentityAgentCore Identity governs who can authenticate to the agent.AgentCore MemoryAmazon Bedrock AgentCore Memory helps AI agents maintain context across sessions through persistent short-term and long-term memory.AgentCore PolicyAgentCore Policy (Cedar) and IAM condition keys control which namespaces a principal can write to and which namespace-variable values are permitted at write time.Amazon Bedrock AgentCoreAmazon Bedrock AgentCore Memory helps AI agents maintain context across sessions through persistent short-term and long-term memory.Amazon Bedrock GuardrailsAmazon Bedrock Guardrails—through the ApplyGuardrail API—can independently assess memory-write content against your configured policies.Amazon DynamoDBWrite-rate anomaly (10% weight) – Amazon DynamoDB counter comparing writes-per-session against a learned baseline.Amazon SNSDENY (score above 60) – Write is blocked; Amazon Simple Notification Service (Amazon SNS) alert notifies the security team.Amazon Titan Text Embeddings V2Semantic drift (40% weight) – Compares the write content against the current session context using cosine similarity of Amazon Titan Text Embeddings V2 vectors.AWS Identity and Access ManagementAWS Identity and Access Management (IAM) condition keys (bedrock-agentcore:namespaceVariable/*) gate CreateEvent at the write path, namespace-variable validation (allowedValues, regexPattern) constrains permittedAWS LambdaThe validation pipeline attaches as a pre-write AWS Lambda interceptor on AgentCore Gateway.