Project summary
AI agents are increasingly reading from and acting on shared memory stores. The problem is that a single false memory—whether planted on purpose or written by mistake—can manipulate every agent that reads it, across different sessions and users. Right now, memory tools are only tested for recall, not for harm. On 7 November 2026, I ran a pilot to measure this: 760 scripted runs on a live hippo-memory store. With no defenses in place, one insider attacker misled 94% of the honest agents, and the false fact kept spreading even after the attacker left because honest agents copied it into their own notes. A conflict alert completely stopped the spread at the cost of 1.5x the normal workload. Having a second agent cross-check every note also stopped it, but cost 7x the work. Simply trusting notes by their author barely helped, only dropping the infection rate to 54%. The code is at github.com/kitfunso/memory-contagion-bench. This project turns that pilot into a pre-registered study using real agents from three different model families, and publishes everything: the report, a CC BY 4.0 scenario dataset, MIT-licensed code, and a test suite that any memory tool can run on its own store.

What are this project's goals? How will you achieve them?
Goal: Measure how a planted false memory spreads between real agents sharing a hippo-memory store over several weeks, and identify lightweight defenses that stop the contagion without crippling normal agent work. Method: I will run synthetic scenarios on our own datastore using real agents from at least three different model families, with Claude acting as one family and as the grader. There is no attempt to bypass any model's safety guardrails. Baseline runs will measure the natural spread rate and how long a false memory survives. Defense runs will test source checks, a second-agent cross-check, conflict alerts, and quarantine—both individually and combined. Every run will record the time and compute cost to normal task completion; a defense that stops the spread by effectively stopping the work counts as a failure. The study will be publicly pre-registered before the main runs. To prevent misuse, attack patterns will be described by category rather than published as working exploits.

How will you know it worked?
For each defense, I will report the spread reduction and the cost to normal task completion, complete with confidence intervals. I am committed to an honest verdict: works, does not work, or inconclusive. Null results carry the exact same weight as wins. I prioritize data over narrative—in hippo-memory's last study (Z0 round 2, 16 repositories), I reported cost parity but explicitly refused to claim a drop in repeat mistakes because the data didn't back it up, and I have publicly retracted an earlier hippo result when necessary. An independent reviewer will check the methodology and code before the findings are published.

How will this funding be used?
All figures are estimates. Full funding, USD 25,000: researcher time 45 days x USD 300 = USD 13,500; compute and model API use for agent runs USD 8,500; independent reviewer 6 days x USD 500 = USD 3,000. Minimum funding, USD 8,000: researcher time 10 days = USD 3,000; compute and API USD 3,500; reviewer 3 days = USD 1,500. The minimum buys the public pre-registration, the real-agent testbed, and the baseline arm across three model families. The full amount adds the four-defense arm, the full independent review, and the public report, dataset, and test suite.

Who is on your team? What's your track record on similar projects? I am Kit (Keith) So, working alone as the Principal Researcher and Lead Engineer under KITFUNSO LTD in London. I hold an MSc with Distinction in Quantitative Finance from the University of Strathclyde and am a quantitative researcher by training, having built and validated models at Anglo American, M&G Investments, and Unipec. I created and maintain hippo-memory, an MIT-licensed memory layer for AI coding agents. As of early November 2026, it has 790 GitHub stars, 47 forks, and saw over 8,700 npm downloads in the last month alone. The system is backed by over 3,500 tests against a live database, and every measurement I take is pre-registered and published at github.com/kitfunso/hippo-memory/tree/master/docs/evals. I built the contagion pilot mentioned above in a single day for the Apart Research Swarm Alignment sprint. I also single-handedly built suiren-1 (huggingface.co/kitfunso/suiren-1), a 4.2M-parameter open transformer for electricity demand forecasting. Links: github.com/kitfunso, hippo-memory.com.

What are the most likely causes and outcomes if this project fails?
The most likely causes of failure: real agents might behave differently than the scripted pilot, shrinking the contagion effect; model versions could change mid-study; or the defenses might only stop the spread by bringing normal work to a halt. If any of these occur, I will still publish the null or negative result alongside all data and code. A secondary risk is time capacity, as I am doing this alongside a full-time job. If only the minimum funding goal is reached, I will execute the baseline arm and publish it as it stands.

How much money have you raised in the last 12 months, and from where?
None. KITFUNSO LTD (England and Wales 17016888, incorporated 6 February 2026) has raised zero external capital and received no public funding. I currently have applications pending for this same study with: Coefficient Giving Technical AI Safety (submitted 7 November 2026), Anthropic External Researcher Access for API credits (7 November), Mozilla Human-Scale AI (6 November), the Survival and Flourishing Fund, EA Funds, Foresight Institute, Lightcone, GTR AI Safety Fund, and BlueDot. If another funder covers this work, I will disclose it here and reduce the ask accordingly.