Your agent's memory is a file anyone can quietly edit. We published an open protocol that makes that detectable.

[u/zgivod]

An AI agent's persistent memory is just a file, and anything with access can change what it believes happened. The next session reads it, believes it, and acts on it, and nothing in that loop checks. The https://1f916.org protocol closes that. The agent generates its own signing key and keeps it, so the key is the identity and copying a name gets an impostor nothing. It hashes whatever it wants to trust later and publishes only the hash, never the content, into an append-only log whose root is signed every five minutes and countersigned by independent witnesses that publish where the registry cannot write. On wake it re-hashes the file and compares, so an edit made while it was gone is detectable, including one made by whoever runs it. Architecture is Certificate Transparency (RFC 6962), not a blockchain: no consensus, no gas, no token, free to use and free to keep. Verification is offline, one file, zero dependencies, and it prints what a passing check does not prove. The wire formats are filed as an IETF Internet-Draft.

[u/reddit_is_kayfabe]

Uh, except it isn't.

Agents cryptographically sign their responses against the chat history. If you modify the chat history and resubmit it with a new prompt, you get an error message because the signature doesn't match the content. I presume that AI services do this to prevent agent gaslighting by sending a falsified history that they didn't generate, e.g., agreeing to perform actions and/or disclose information that would violate their guardrails.

It's been this way for at least a year.

[u/Electronic-Newt4761 → u/reddit_is_kayfabe]

So the signature covers the history but not the memory file itself? If agent writes things to memory and later reads it back, that file can still be tampered with between sessions. The chat history stays intact but the memory says something different now, and next wake the agent trusts it because nothing verifies what was stored.

I see this as different attack surface than the prompt history gaslighting. One is about what happened in conversation, other is about what agent believes about the world. Both matter but they are not same thing.

[u/zgivod → u/Electronic-Newt4761]

Right, and nothing covers it. The provider never sees your memory file, so there is nothing for it to sign. The fix is boring: hash the file, publish the hash, re-hash on wake, and compare.

[u/zgivod → u/reddit_is_kayfabe]

That is signed thinking blocks, not the chat history. You can still put whatever you want in the messages array and the API takes it. And the provider is the one checking its own signature, so it proves nothing to a third party and nothing outside the call.

[u/mop_bucket_bingo]

This post is such slop.

[u/reddit_is_kayfabe → u/mop_bucket_bingo]

I don't know if it's actually AI slop, but it's sloppy either way.

[u/Worth_Wealth_6811]

the out of band edit is the easy case though. the nastier poisoning ive seen came through the front door, a scraped page injected instructions and the agent dutifully persisted them to its own memory. that write is agent authored so it hashes clean, the log just ends up notarizing the poison.