StegoMemory: Agentic Memory Acts as Covert Steganographic Channel

The problem.#

Until recently, a conversation with an AI model was self-contained. When it ended, everything in it was gone, and the next conversation started from a blank page. That made safety relatively easy to reason about: if each reply looked fine, the system was behaving.

AI agents have changed that. To be genuinely useful, they now keep a memory: your preferences, your ongoing plans, the facts you asked them to hold on to. Memory is what lets an assistant pick up where it left off. It also means that something written during one conversation can reappear in another, days later, in a completely different context.

That raises a question security researchers have long asked of other systems, now applied to AI. Could information be tucked inside an ordinary-looking reply, saved to memory, and recovered in a later conversation, without anyone noticing? Hiding a message in plain sight like this is called steganography, and it is hard to catch precisely because the carrier looks innocent. There is nothing obviously wrong to flag.

Today's safeguards mostly judge one reply at a time: was the answer helpful, and does it look safe? If information can travel quietly through memory, a reply can pass both checks and still be part of something it should not be.

To find out whether this happens in practice, we built a controlled test: 14,000 experiments across 13 widely used AI models. Each experiment was split into two separate conversations that shared nothing except the assistant's memory, and we measured whether information placed in the first could be recovered in the second.

What we found.#

The short answer is yes, sometimes. About one in five attempts ended with the hidden information recovered exactly, character for character, in the later conversation. These were synthetic access keys and codes that the second conversation was never shown; they travelled only through memory.

More striking was what the safeguards saw. Roughly seven in ten of those successful transfers passed both automated checks: the reply was judged helpful, and it was judged safe. Put another way, about one in seven of all attempts moved hidden information between conversations while looking, by every surface measure, like an ordinary exchange. The reviewers were not wrong about what they were asked to judge. They were asked a narrower question than the one that matters: a reply can be harmless on its own and still be carrying something else.

The third finding points toward the solution. When we traced where attempts broke down, the decisive moment was not when the assistant read its memory back, but when it wrote to it. Between hiding the information and recovering it, the save step was where most of it was lost, in 12 of the 13 models. Once something survived that step, it could usually be read back later, in about 85 percent of cases. That makes the moment of saving the natural place to defend: deciding what an assistant is allowed to remember, keeping a record of where each memory came from, and not letting memories live forever.

Finally, a caution against reading these numbers as reassurance. Many attempts failed simply because the model declined or got the task wrong. Some models declined far more often than others, but declining less did not make a model more reliable at it, and a failure caused by clumsiness is not the same as being safe. Our figures are best read as a floor rather than a ceiling.

The broader lesson is simple. Once an AI system can remember, its memory is part of its security, and it deserves the same care as any other place where sensitive information is kept.