PERSIST : Threat Modeling Memory‐Persistent AI Agents in Cloud‐to‐Edge Environments

Agentic artificial intelligence systems increasingly depend on persistent runtime memory, including vector databases, episodic memory stores, long‐term retrieval indices, and cloud‐to‐edge replicas. Existing security frameworks address prompt injection, data poisoning, and model‐level risks, but they do not fully model persistent memory as an active behavioral surface whose records can be written, synchronized, retrieved, transformed, revoked, and later used as decision context. This article introduces PERSIST, a STRIDE‐extended threat model for memory‐persistent AI agents in cloud‐to‐edge environments. PERSIST defines six threat classes: poisoning of persistent memory, exfiltration through retrieval channels, retrieval injection and prompt‐via‐memory attacks, state corruption across synchronization, identity and provenance loss, and temporal drift exploitation. The article extends the threat model with a runnable controlled prototype using SQLite and sqlite‐vec with one cloud vector store, six edge vector stores, HMAC‐signed memory envelopes, top‐k vector retrieval, revocation propagation, and retrieval‐time policy gates. Within a synthetic workload and across 20 repeated trials per main design, PERSIST‐Cloud produced lower observed poison exposure than baseline synchronization (8.9% vs. 46.2%) and signed hash‐log synchronization (8.9% vs. 47.6%), with a 95% confidence interval of 6.6%–11.9% for PERSIST‐Cloud. No cross‐scope retrieval was observed under PERSIST‐Cloud in the tested workload, and observed high‐risk unsafe retrieval was 7.9% (95% CI: 6.0%–10.4%). The paper further operationalizes the proposed Provenance Entropy metric by specifying baseline construction, threshold calibration, and deployment‐time monitoring, and it discusses edge‐node trade‐offs for metadata, verification, latency, and retrieval blocking. These findings provide controlled mechanism‐level evidence about the comparative behavior of the proposed controls; they do not establish effectiveness in production agentic systems or real cloud‐edge deployments.