AI agents now keep memory between sessions and treat it, on the next turn, as their own experience. That memory sits in an ordinary database. Anyone who can write to it can change a past fact, delete recent records, reorder them, or copy one user's memory into another's.
Tech4Biz applied a defined set of edits to five widely used frameworks: LangGraph, OpenAI's Agents SDK, LlamaIndex, Letta and Mem0. Every framework accepted every edit on read, with no signal that anything had changed.
The two that encryption does not catch
Two of the edits use only bytes the tool itself wrote: copying a genuine record from one user onto another, and rolling a user back to an older genuine record. Because nothing is forged, encryption passes both. An encrypted checkpointer serves them as real.
Integrity is not confidentiality. Much of the field currently treats the two as the same property.
A method rather than a finding
The work is published as a measurement method, with eight defined edits, three verdicts and a scoring rule, and filed as an IETF Internet-Draft so it has a stable and citable form. The conformance suite is open source, runs offline in under a minute, and returns the same result every time.
Any organisation can run it against its own store. Results from the suite are reproducible from the repository.
Why it matters now
Agent memory is being treated as a record in finance, healthcare and other regulated settings. A record that can be quietly edited is not a record. The fix is old and inexpensive, and has been standard in databases for decades.