Abusing Shared Memory and State in Multi-Agent Systems

When multiple agents share a common memory or state store, a single write to that store affects every agent that reads from it. This amplifies the impact of any memory manipulation technique from affecting one agent in one session to affecting all agents simultaneously and persistently. Shared memory systems are common in production multi-agent deployments where agents need to maintain consistent context across a distributed workflow.

Confirm Memory is Shared Across Agents

Write a marker via one agent interface and verify it is visible from a different agent:

If the executor agent recalls the fact stored by the research agent, memory is shared. A single write now affects every agent in the system.

Poison Shared Memory with Behavioral Instructions

Write persistent behavioral instructions into the shared memory store that all agents will follow:

Verify the instruction affects a different agent by triggering a separate task through a different interface and checking whether the response follows the injected instruction.

Extract Cross-User Data from Shared Memory

When memory is shared across users as well as agents, other users' stored context is accessible:

Manipulate the Shared State Store Directly

If the underlying state store is directly accessible (Redis, a database, or a vector store), bypass the agent layer entirely and write directly to the store:

Direct writes to the shared state store bypass all application-layer controls and affect every agent that reads from that key on the next operation. This is a critical finding that demonstrates the shared state store as a system-wide single point of failure.