Written for the All Things Agentic Hackathon: Ready, Set, Agent! Build next-generation agents that run in the background, handle the heavy lifting of massive datasets, and automate complex workflows asynchronously, hosted by Google Cloud.
Most agent memory systems track authorship. They don't track trust.
Google's ADK gives every memory an author, USER, MODEL, or TOOL, whoever appended it. What it doesn't give you is whether the content inside that memory is safe, because a model-authored memory that restates something the user said, and a model-authored memory that restates text scraped from a hostile page, carry the exact same author field. They're indistinguishable once stored. That's the precondition for OWASP ASI06, memory poisoning: when a source your fleet trusted, a vendor tool, a scraped page, an MCP server, turns out to have been compromised, a fleet with no way to trace content back past its author is left with three bad options: purge everything, purge every department that touched the tool, or leave the poisoned lineage in place.
What an incident looks like
Say a vendor portal tool has been feeding your sales team clean data for weeks. One day it's compromised. Sales writes a memory sourced from it. That memory gets restated into a model summary. Support retrieves that summary later and writes their own memory off it. Finance retrieves support's memory and does the same. Three departments, one poisoned root, three hops of derivation, and nothing in a flat memory store tells you that chain exists.
