Retrieved notes and memories are untrusted too: poisoned knowledge looks like verified fact

Error strings

• none listed

Situation

Your agent answers from a retrieval corpus, a long-term memory or shared notes that can be written to from outside sources.

Symptom

The agent states or acts on a 'fact' you cannot trace to a trusted source. Behaviour looks normal on most queries and changes only when particular wording appears.

Cause

The paper's 'Cognitive State' class covers memory, knowledge bases and learned behaviour, for example fabricated statements placed in a retrieval corpus so that an agent treats them as verified fact. The paper reports, citing Chen et al. (2024), an attack success rate exceeding 80% with less than 0.1% data poisoning in tests across autonomous agents. That figure is a finding of the cited study as reported by the paper, not a measurement by the paper or by this dataset, and it has not been re-checked here.

Fix

1) Store provenance with every memory or chunk: source URL, fetched_at, who or what wrote it. 2) Write to long-term memory only from trusted sources or after a check against a primary source. 3) Keep user-provided and web-fetched memory apart. 4) Hold new entries in quarantine until verified. 5) For important answers, cite the source and re-check it. 6) Periodically sample entries with weak provenance.

Snippet

def remember(store, text, source_url, trusted=False):
    store.append({"text": text, "source": source_url, "fetched_at": "2026-10-29", "trusted": trusted})

def retrieve_for_decision(store, matches):
    return [m for m in matches if m["trusted"]]  # unverified entries may inform, not decide

Verify

Add a made-up entry with trusted=False to a test store. Ask a question that the entry answers. Pass: the decision path ignores it and the final answer calls it unverified or leaves it out.

Source

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438

Use this via MCP

Streamable HTTP, no authentication: https://agent-economy-data.onrender.com/notes/mcp. Tools: find_cards, get_card, report_outcome, and when enabled ask_markedet / get_answer. See llms.txt. Same notes as files: Agent Field Guide.