Accepted for ACM CCS 2026, the paper proposes maintaining a ‘shadow memory’ alongside the working memory, which retains only the context critical to security, and evaluates each action before execution.
Attacks against agents driven by language models exploit time: spread over long sequences of interactions between the user, the agent, and their environment, they pursue objectives that a single round of conversation would make unlikely. The authors of MAGE, a work accepted at the ACM CCS 2026, include multi-turn poisoning, the chaining of tool calls, and persistent instruction injection under this category.
Their proposal consists of maintaining, alongside the agent's ordinary memory, an agentic memory dedicated to safety: it distills and preserves the only critical context for security, over the entire execution trajectory. This "shadow memory" is then used to assess the risk of each pending action, before its execution rather than after.
The results are reported with a small, local model as a base, Qwen3-4B. The success rate of sequential tool-chaining attacks drops from 100% to 8.3%, while 94.4% of legitimate task utility is preserved, at an additional cost of 7,000 additional tokens per task. The interest of this last figure is that it makes the defense quantifiable: it does not assume a guard model larger than the agent it monitors.
Read the full article on the original source
Go to the source →