What I learned auditing an open-source AI-memory SDK (and the bug I found in it)

An open-source AI-memory SDK called MemWal / Walrus Memory was audited, revealing that the true vulnerabilities lie in ownership checks and sample apps. While AI memory is often discussed for its ability to retain user data across sessions, the real issues stem from proper ownership checks in the system. A bug was found in a sample chatbot app that allowed users to vote on messages they did not author, by using another user's message ID.

This would silently insert a mismatched row, causing the real message owner to be unable to vote on their own message. The maintainers quickly fixed the issue by ensuring the existence check and update were scoped identically. The lesson learned is that while core SDKs, auth layers, and contracts may be well-hardened, sample apps often contain critical bugs that go unnoticed.

It's crucial to review and validate code across all applications and demos, as a single oversight can lead to significant security issues. Furthermore, it was discovered that some sibling apps may have missing or incomplete security measures, such as on-chain verification steps, even if they are not extensively scrutinized. The development of persistent memory/state across sessions for AI agents requires careful attention to security measures, as copy-pasted code may not automatically include security fixes.

The author invites further discussion on how to address these challenges in the context of multi-tenant AI systems. This story was part of Walrus Sessions 8, a hackathon track focused on building or retrofitting chatbots that utilize Walrus Memory to remember context across sessions, users, and devices. The event offered $2,500 in WAL prizes, with a standalone Bug Bounty track providing $100 for each reproducible bug found in GitHub.