AWS publishes defense-in-depth write-validation pattern to defend Bedrock AgentCore Memory against memory poisoning

On Nov 9, 2026 AWS Security Blog published a pattern that combines AgentCore's built-in controls (IAM condition keys, namespace-variable validation, custom consolidation prompts, ApplyGuardrail API) with a composable pre-write Lambda interceptor on AgentCore Gateway. It scores memory writes on semantic drift (Titan Embeddings V2 cosine similarity), injection-pattern regex, namespace-boundary structure, and write-rate anomaly, returning ALLOW/QUARANTINE/DENY, with quarantine isolation and SNS alerting.

Memory poisoning is persistent indirect prompt injection that can survive across sessions and, in shared namespaces, poison every agent and user that reads the memory — a control point most agent platforms leave unguarded. This gives teams a concrete, code-free way to detect non-English/obfuscated injection at the write path.

Teams running Bedrock AgentCore with persistent memory, especially shared namespaces, should implement the pre-write validation layer; offer to AWS customers building memory-backed agents.