ZoneClaw: Partitioning AI Agent Memory Drops Persistent Attacks from 372 to 6 Out of 480 Successes

Researchers show that trapped external content can become inscribed in an agent's memory and guide future tasks, and propose hierarchical areas of trust to prevent them from doing so.

Agents that use a computer on behalf of the user, similar to OpenClaw, store their memory in files that are reloaded each session. User instructions, system-generated summaries, and claims gleaned from the web coexist at the same level of privilege. A team that includes Ee-Chien Chang describes the resulting "persistent memory attack" in an article posted on arXiv on September 30: an attacker who controls only seemingly innocuous external content causes the agent to memorize a statement during a legitimate task, which will then guide other tasks that the attacker has never touched.

Separating what we remember from what is authoritative

ZoneClaw replaces flat memory with tiered trust zones. Information from the outside is well preserved, but in a low-trust zone; to influence an action, it must cross an explicit boundary where it is cross-checked with areas that the attacker cannot change. Separately privileged processes ensure that no component can both read external content and act outwards.

Across four attack scenarios, two injection modes, and four basic models, the number of successful attacks drops from 372 to 6 out of 480 attempts, while the agent still performs 458 legitimate tasks out of 480. The authors point out that the defense also resists some attackers who know it, and publish their code.