litellm - 💡(How to fix) Fix Feature request: OWASP ASI06 memory poisoning defense integration for LiteLLM agent deployments

Summary

OWASP recently published the Top 10 for Agentic Applications, which includes ASI06: Memory Poisoning — a threat specific to AI agents that persist memory across sessions.

LiteLLM is increasingly used as the backbone for multi-agent deployments. When agents built on LiteLLM persist conversation history or session state, they become vulnerable to memory poisoning attacks where malicious inputs get stored as "trusted" context, influencing future LLM calls.

The threat

When an agent's memory/context is persisted (conversation history, retrieved context, tool outputs), a malicious actor can craft inputs that get stored as "trusted" memories. Those poisoned memories then influence future LLM calls — causing data leakage, unauthorized actions, or persistent manipulation across sessions.

This is OWASP ASI06: Memory Poisoning, formally recognized in the OWASP Top 10 for Agentic Applications.

Proposed integration

The OWASP reference implementation for ASI06 is agent-memory-guard (Apache-2.0, pure Python, zero external dependencies):

pip install agent-memory-guard

Suggested integration points for LiteLLM:

1. Optional memory guard middleware in the LiteLLM proxy for agent deployments
2. Documentation guidance on memory security best practices per OWASP ASI06
3. Integration example showing how to wrap conversation history with OWASP ASI06 defenses

References

• OWASP Top 10 for Agentic Applications: https://genai.owasp.org/
• agent-memory-guard (OWASP reference impl): https://github.com/OWASP/www-project-agent-memory-guard
• PyPI: https://pypi.org/project/agent-memory-guard/

Happy to contribute documentation or a PR if there's interest.