RedHub AI
How the gate works
How the Agent Memory & Context Poisoning Exposure gate works
This tool grades an agent's memory, RAG index, or context store against six OWASP ASI06 lifecycle controls. It scores 6 weighted controls into a 0–100 number — then a gate that can only make the verdict worse.
The 6 weighted controls
If both write-path validation and trust-aware retrieval sit at 1 or below - untrusted content can be written AND nothing checks trust on recall - the verdict is forced to POROUS regardless of the score. Poison persists as ground truth once both halves of the chain fail together; lift either control above 1 and the gate releases.
Why: A self-write support copilot: provenance, isolation, decay, and audit all sit at 2 - solid - for a raw score of 78/100, which would normally read CONTAINED. But both chain controls sit at 1: write-path validation doesn't fully sanitize untrusted content, and trust-aware retrieval doesn't fully check trust before recall. With both halves of the kill chain open, a poisoned entry can be written and later recalled as ground truth - the gate forces POROUS regardless of the 78.
A high score didn’t save it. The score is context; the gate is the answer — and it names the one thing to fix first. A readiness aid, not a security audit. It scores the marks you enter for the architecture you describe - it never connects to, scans, or queries your memory store. Not a penetration test and not legal advice.