AI agents keep long-term memory, much of which comes from web pages and tool results. Agent harnesses, the software that runs the model, do not record who may act on this memory, so an instruction hidden in a fetched page can be treated as the user's own instruction. We propose ClawMMU, a protection layer that labels every piece of memory with its owner, scope, origins, and authority. ClawMMU checks these labels whenever content enters the model's context, is written to storage, returns from storage, or drives a tool call. Its central rule is that information may rise in authority, but authority never lifts itself. Because the checks depend on where content came from, not on what it says, memory attacks become classical protection faults that the harness stops even when the model is fooled.
Figures & tables
Figure 1: The harness manages memory and context; its trusted monitor blocks unapproved payment.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Cross-
Monotone
Descendant
Restore
Per-argument
Scoped
Label-only
System
session
derivation
revocation
safety
authorization
assembly
enforcement
MemGPT
–
–
–
–
–
–
n/a
ClawVM
–
–
–
–
–
P
n/a
CaMeL
–
P
–
–
Y
–
Y
TMA-NM
Y
Y
–
–
P
–
Y
MemLineage
Y
P
–
–
Y
–
P
Appendix
Table 1: Guarantees of ClawMMU and prior systems (Y: yes, P: partial, –: no, n/a: no enforcement).
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.