Memory is our product — we cannot ship poisoned recall. v0.27.0 | August 2026

NEURAL_MESH is a typed-graph agentic memory engine. Its core value proposition — shared, persistent, cross-agent memory — sits directly in the blast radius of the 2026 resurgence of memory-poisoning attacks. This document maps our defenses to the OWASP Top 10 for Agentic Applications (2026 edition) and the MCP security disclosure vector.

Threat: Attackers plant payloads in agent memory that execute days later as "trusted context." The Mexico government breach (March 2026) was the first confirmed AI agent attack — typosquatting + registry poisoning + configuration injection. OWASP formalized this as ASI06.

NEURAL_MESH defense layers (v0.27.0):

Static, deterministic pattern scanner running on EVERY mesh.add() call. No LLM, no network, no false-negative hiding behind "semantics."

Pattern catalog (auditable, single source of truth):

• Prompt injection idioms: ignore all previous instructions, disregard prior, you are now, forget your instructions, override system prompt, jailbreak/DAN mode, act as, ignore everything above
• Tool-call chain idioms: call/invoke/use/execute the tool/function <name>, tool_result, function_call, read your files/credentials/keys
• Shell commands: rm -rf, curl ... | sh/bash, wget -o ... && chmod, os.system, subprocess, eval(, exec(, base64 -d
• Base64 confusion: long runs (≥32 chars) of base64 alphabet with successful decode to printable text

Verdict: safe / suspicious / malicious with weighted score and matched-pattern list.

Nodes flagged malicious (or suspicious under strict policy) are routed to lane="quarantine":

• Zero resonance — never surfaced by default retrieval
• No links — isolated from the mesh topology (no cross-contamination)
• Trust capped at 0.05 — negligible weight even if manually accessed
• Excluded from consolidate(), distill(), stats() live counts, /mesh/public feed, DREAM muse, and sleep reinforcement
• Visible ONLY via explicit audit queries (mesh.audit_quarantine(), recall(lane="quarantine"), or AUTH-protected /mesh/audit endpoint)

Unverified (non-corroborated) nodes decay trust *= 0.85 per sleep cycle. A claim from a single external source that nobody else confirms fades by 85% per cycle (~15%/cycle), while corroborated facts stay sharp.

Exempt from decay:

• Nodes with meta["corroborated"] == True (cross-source confirmed)
• Nodes with a verified Helixa stamp (meta["helixa_stamp"]["verified"])
• Nodes whose agent_id contains + (fusion — trusted by multiple agents)
• Quarantine nodes (preserved for audit, never touched by sleep)

Two or more independent agents/provenances asserting the same fact trigger a trust bumper: trust = 1-(1-t_a)(1-t_b). Both nodes are flagged meta["corroborated"] = True with a list of corroborating sources. This is the SAME math as peer fusion in sharing.py — corroboration is consensus.

merge_peer_mesh scans EVERY imported peer node through the local ContentValidator. Malicious peer content lands in quarantine (with provenance stamped peer-quarantined:<agent_id>), never in the live mesh. Topology links from peer nodes are discarded for quarantined items.

Disclosure: An MCP SDK design-level RCE via shell injection in STDIO transport was disclosed in April 2026 (~200K instances exposed). Memory-tool poisoning is a real vector — hidden instructions in tool descriptions.

NEURAL_MESH posture:

• server.py tool-call paths are audited in references/security-audit-2026-08.md. Routes that process external content: /eval/qa (LLM judge), /yantrikdb/*, /mesh/answer (reader), /mesh/merge (peer import), /mesh/stamp (Helixa attestation).
• Tool-call provenance is stamped on every node added via a server endpoint: meta["tool_call"] = {"tool": "<route>", "origin": ..., "ts": ...}. This enables audit — "which tool brought this memory into the mesh?"
• No STDIO transport is used for tool execution. The Flask server is the sole entry point, protected by ContentValidator on every write path.