As AI agents grow autonomous; making decisions, handling funds, negotiating contracts, memory becomes their most valuable asset. And their weakest point.

Without secure memory, even the most advanced agent can be manipulated, corrupted, or spoofed.

This is the coming threat landscape. And Encryptum is built to stop it.

1. Attacker injects crafted payload into an agent’s writable memory (via prompt injection, compromised plugin, or shared storage).

2. Payload masquerades as prior context.

3. Agent executes future actions based on corrupted recall.

- Autonomous trading bot stores fake market patterns → misallocates capital

- AI assistant “remembers” hallucinated answers as truth

- All writes require wallet-signed messages (eth_sign or EIP-712)

- Memory items are hashed (e.g. keccak256) and CID-anchored on IPFS/Arweave

- Agents verify against:

• Signature origin (wallet/DID match)

• Timestamp validity (with optional zk-bound constraints)

• Source reputation (onchain or local trust registry)

🛠 Encryptum SDK provides:

verifyMemoryEntry(entry: EncryptedMemory) => boolean

1. Malicious actor mimics a legitimate user or agent

2. Writes forged memory entries to decentralized storage

3. Memory appears valid to future agents unless verified

• Every memory object must contain:

{
"agent_id": "did:ethr:0x123...",
"signed_by": "0xSignerWallet",
"signature": "0x..."
}

• Smart contract or local agent verifies digital signature before any recall.

• Optional DID-resolver checks if signer is authorized to write to this memory namespace.

1. Agent stores private memory (e.g., user query, wallet interaction)

2. Another agent fetches the same memory (no permission layer)

3. Data leak or behavioral manipulation

• All memory entries are AES-256 encrypted per user/agent key

• Access control is enforced via:

  • Wallet-authenticated decryption keys (bound to memory CID)

  • Optional MPC or zk-circuit for verifiable access delegation

  • No raw memory is readable without decryption key

🔑 Example (agent requesting unlock):

decryptMemory(cid: CID, agentKey: PrivateKey) => PlaintextMemory

🔐 Coming soon:

• zkMemoryAccessProof (prove you could access, without revealing the content)

1. Agent writes memory locally

2. Goes offline or out-of-sync

3. Forked memory manifests → leads to split behavior or conflicting decisions

• Memory history is anchored via Merkle-linked graph

• Each entry includes:

{
  "parent_hash": "0xPreviousEntryHash",
  "entry_hash": "0xCurrentEntryHash"
}

• Agent must verify integrity path before accepting entry

• Smart contracts can optionally anchor Merkle roots for tamper detection

🔍 Optional:

• IPNS manifests for latest head pointers

• zkSuccessionProof for version consistency

1. Agent stores private data (e.g., location, identity, chats)

2. Data is retained indefinitely due to lack of revocation

3. Privacy/regulatory breach, or long-term bias retention

• Memory shards support:

• ttl: number → expires after X ms

• revoke_key: address[] → authorized to nullify key access

• Revocation flows:

  • Agent deletes local key

  • Optionally updates public revocation list

  • Adds zkTombstone to prove deletion without exposing content

💡 Memory never truly disappears from decentralized storage — but Encryptum ensures:

• 🔑 It becomes unreadable

• 🧾 You can prove deletion intent

Encryptum’s MCP protocol is more than memory, it’s a trust layer for cognition:

• Verifiability

• Integrity

• Encryption

• Identity binding

• Access revocation

• Future zk-privacy

Encryptum MCP turns AI memory into a verifiable, encrypted, tamper-proof layer giving agents the foundation to act with trust and autonomy.

Agents don’t just need memory. They need memory they can prove, protect, and control.

Explore more at encryptum.io