PROVENANCE + SEALED EGRESS // 2026
Memsom is a memory that refuses to repeat anything it can't prove. Secure Fetch lets it read the internet without the internet reaching back into your network.
The problem // ASI06 + CWE-918
AI assistants have memory now, but memory believes whatever it is told. Slip a false "fact" into it through a webpage, an email, or a sketchy document, and the AI later repeats that lie as gospel. You would never know where it came from.
OWASP ASI06 // 2026
To be useful, an AI often has to read a webpage for you. The moment you let it fetch a URL, you have handed it a loaded gun. A malicious link makes it reach back into your private network: your router, your files, your internal systems.
CWE-918 // SSRF
Memsom // Provenance Memory
A courtroom for facts. Everything the AI knows arrives with a receipt: who said it, and how much you should trust them. What you tell it directly is a trusted witness. What it read off a random page is an unverified stranger. Trust is assigned by the channel a fact came through, never by how confident the fact sounds.
The rule that holds it together: when facts combine, the conclusion is only as trusted as its least trusted ingredient. One stranger in the mix and the whole conclusion is stamped unverified. A lie can't launder itself into a truth by sitting next to real facts. That is the difference between gossip and journalism. Memsom forces a citation, or it tells you it can't.
The trust ramp
Stamped EXTERNAL. One red input drags the whole conclusion down to red.
SECURE FETCH // SEALED EGRESS
To be useful, an AI often has to read a webpage for you. The moment you let it fetch a URL, you have handed it a loaded gun. So we read the dangerous page the way a scientist handles a virus. Inside a glovebox. Hands go in, the threat never gets out.
A malicious link wants to turn your assistant against your own network. It points the fetch back at your router, your files, your internal company systems. Security people call this SSRF, and it is one of the nastier web attacks. Secure Fetch is built so that even a page actively trying it has nowhere to go.
The part that touches the open internet is caged. The part that reads the page is sealed off from the internet entirely. And nothing read off the web walks in trusted. It gets screened first.
Egress is owned by the cage. The page never reaches your network.
The handoff // Quarantine > Promote
Secure Fetch reads the web. The info is staged, untrusted, untouched by your memory.
The same fact must be confirmed by multiple independent sources that agree. One site is not enough.
Only then is it written into Memsom as trusted, with its receipt attached.
Secure Fetch is the airport security checkpoint. Memsom is the country behind it. You only get a passport stamp if your story checks out from more than one angle.