Security: OWASP ASI06 memory poisoning defense for Spring AI agent memory

Memory Poisoning Defense for Spring AI Agents (OWASP ASI06)

Hi Spring AI team 👋

Spring AI is the primary framework for building AI applications in the Java/Spring ecosystem. As Spring AI's ChatMemory and vector store integrations are used in production agentic workflows, ASI06 — Memory Poisoning (from the OWASP Top 10 for Agentic Applications 2025) is an important security consideration.

The Threat

Malicious content written into an agent's ChatMemory or vector store can persist across sessions and silently alter future model behavior — without triggering any model-level safety filter.

Reference Implementation

OWASP Agent Memory Guard is an official OWASP reference implementation (Python) that defines the scan-before-write pattern for memory stores. The core algorithm is language-agnostic and could be ported to Java or called via a sidecar.

from agent_memory_guard import MemoryGuard
guard = MemoryGuard()
result = guard.scan(memory_content)
if result.is_safe:
    chat_memory.add(memory_content)

Ask

Would the Spring AI team be open to:

1. A security note in the ChatMemory documentation about ASI06?
2. A MemoryAdvisor interface that supports pluggable memory validation?

Happy to draft a docs PR or a Java interface design proposal.

Start with Spring AI's ChatMemory and vector store integrations, then read the linked OWASP Agent Memory Guard reference for its scan-before-write pattern. The issue proposes either an ASI06 security note in ChatMemory documentation or a pluggable MemoryAdvisor validation interface, so scope and acceptance criteria need confirmation before implementation.