ClawMMU protects AI agent memory by tracking content ownership
ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents
Cryptography and SecurityArtificial IntelligenceOperating Systems
Summary
AI agents store long-term memories, like information from web pages or results from tools, but current systems don't track who owns or controls those memories. This can let hidden instructions from web pages be mistaken as user commands. The authors propose ClawMMU, a system that labels every memory with its owner, origin, and authority, then checks these labels whenever the memory is used or changed. This way, if the AI tries to act on unauthorized content, the system blocks it, even if the AI is tricked.
What this means in practice
- •For ai system developers: Prevent unauthorized instructions from web content affecting AI agent behavior by enforcing memory ownership and authority checks.
- •For cloud security engineers: Increase the security of AI services by isolating and controlling memory authority across multi-tenant models and tools.
Authors
Jinhao Hu, Bardia Mohammadi, Mofasshara Binte Rafique, Lars Henning Klein, Akhil Arora, Ashvin Goel, Laurent Bindschaedler
Abstract
AI agents keep long-term memory, much of which comes from web pages and tool results. Agent harnesses, the software that runs the model, do not record who may act on this memory, so an instruction hidden in a fetched page can be treated as the user's own instruction. We propose ClawMMU, a protection layer that labels every piece of memory with its owner, scope, origins, and authority. ClawMMU checks these labels whenever content enters the model's context, is written to storage, returns from storage, or drives a tool call. Its central rule is that information may rise in authority, but authority never lifts itself. Because the checks depend on where content came from, not on what it says, memory attacks become classical protection faults that the harness stops even when the model is fooled.