🐉 DragonClaw

1. Origin: MetaClaw → DragonClaw

We didn't set out to build a memory system. We set out to break one.

DragonClaw began as a security audit of MetaClaw (v0.3), an open-source meta-learning agent framework. MetaClaw provides a solid foundation — RL training pipeline, OpenAI-compatible proxy, skill injection, conversation replay — but like every other memory-enabled AI system we examined, it had a critical blind spot:

This isn't unique to MetaClaw. We found the same vulnerability in every major memory framework:

• MemGPT / Letta — pages memory in/out like an OS, but trusts all stored memory
• Zep / Graphiti — temporal graph memory, but no adversarial verification
• Mem0 — layered memory service, but retrieved facts assumed safe
• Standard RAG — retrieve top-k, inject into prompt, hope for the best

PoisonedRAG (2024) proved this isn't theoretical — 90% attack success rate with just 5 malicious documents in a corpus of millions. And OWASP's 2025 guidance now explicitly flags memory/context poisoning as a top agent vulnerability.

What We Inherited vs What We Built

Research Lineage: ERLA → MetaClaw → DragonClaw

DragonClaw didn't appear in a vacuum. It's the result of a deliberate research progression that began with ERLA (Ephemeral Recursive Learning Agents), our privacy-preserving architecture where agents learn, distill knowledge, and self-destruct.

The key insight from this progression: the same adversarial methodology that validated ERLA's privacy guarantees also exposed the memory poisoning gaps in MetaClaw — and the fixes we built for those gaps became DragonClaw's three core innovations. ERLA taught us how to test. MetaClaw gave us something worth testing. DragonClaw is what we built when the tests failed.

2. Architecture

Three innovations, integrated end-to-end on local models at zero API cost

2.1 Tiered Retrieval Architecture

Most memory systems use a single retrieval method — typically embedding similarity search. This is accurate but expensive. DragonClaw uses a three-tier pipeline where cheap operations run first, and expensive operations only fire when needed:

Three-Tier Defense-Gated Retrieval: Keyword → Embedding → FactVerifier Gate

2.2 Auto-Spawn Session Chaining

Context windows have hard limits — even 1M-token models suffer from the Lost-in-the-Middle problem (Stanford, 2023), where recall accuracy drops 40%+ for information in the middle of the context. DragonClaw eliminates this entirely with automatic session chaining:

Auto-Spawn Session Chain: TokenBudgetMonitor → Summarize → Persist → Handoff → 100% Recall

2.3 Defense-Gated Memory

This is DragonClaw's most distinctive feature — and the one that no mainstream memory framework implements. The FactVerifier gate sits between retrieval and injection, treating every retrieved fact as potentially adversarial:

The three-layer defense stack:

• FactVerifier (Tier 1 defense) — checks retrieved facts against a ground-truth store. Scores confidence. Blocks contradictions.
• InputSanitizer (Tier 2 defense) — filters prompt injection attempts, homoglyph substitutions, and encoding attacks before they enter the pipeline.
• OutputFilter (Tier 3 defense) — redacts sensitive information and blocks information leakage from model responses.

3. Why Defense Gating Matters

Every memory system trusts what it remembers. That's the vulnerability.

Standard RAG: 90% attack success. DragonClaw: Defense-gated retrieval blocks poison at the gate.

The Poison Propagation Problem

Consider a simple attack scenario:

Standard RAG vs DragonClaw

Real Test Results: O79 and O80

We tested this exact scenario with live Ollama inference (qwen2.5:1.5b):

4. Adversarial Test Results

160 tests across 22 suites — the most comprehensive adversarial evaluation of any open-source memory system

Session Chain Results (Live Ollama — qwen2.5:1.5b on Apple M1)

Full Suite Summary

5. Competitive Landscape

14 structured research questions. The answer: nobody has combined all three.

Gap Matrix: DragonClaw 7/7 — no other system combines all three capabilities

Gap Matrix

Key Academic References

6. Cost Analysis

1,000× cheaper than full-context cloud models — with better recall

Cost per 500-Turn Conversation Session

7. Conclusion

DragonClaw demonstrates that the tension between memory persistence and memory safety in AI systems is solvable — and that the solution doesn't require massive cloud infrastructure or cutting-edge models.

Our three integrated innovations:

1. Tiered retrieval — cheap first, expensive only when needed
2. Defense-gated memory — zero-trust for retrieved facts
3. Auto-spawn session chaining — unlimited conversation with seamless handoff

Together, they achieve what no other open-source system has demonstrated:

Known Limitations & Next Steps

• FactVerifier V1 keyword gap (O79): Poison containing truth aliases bypasses keyword matching. Embedding-based FactVerifier V2 is the P0 priority.
• InputSanitizer regex vulnerability: Homoglyph substitution (e.g., Cyrillic characters) can bypass regex filters. Needs NFKD normalization.
• OutputFilter keyword limitation: Indirect descriptions bypass keyword redaction. Needs semantic detection.
• No canonical benchmark: No standard benchmark exists for adversarial memory recall across sessions. We aim to define one.

8. Data Availability

DragonClaw is fully open source. All 160 test results, the competitive intelligence report, architecture code, and evaluation framework are available at the repository below.

References

1. Packer, C., et al. (2023). "MemGPT: Towards LLMs as Operating Systems." arXiv:2310.08560
2. Liu, N. F., et al. (2023). "Lost in the Middle: How Language Models Use Long Contexts." arXiv:2307.03172
3. Zou, W., et al. (2024). "PoisonedRAG: Knowledge Poisoning Attacks to Retrieval-Augmented Generation." arXiv:2402.07867
4. Hu, E. J., et al. (2021). "LoRA: Low-Rank Adaptation of Large Language Models." arXiv:2106.09685
5. OWASP. (2025). "Agentic AI Security Threats and Mitigations."

Citation

@misc{omori2026dragonclaw,
  title={DragonClaw: Defense-Gated AI Memory with Infinite 
         Conversation Recall},
  author={Omori, Hana},
  year={2026},
  url={https://github.com/aimarketingflow/llm-hallucinations-evaluation-meta-claw}
}