AI agents that remember how they think are now a target for memory poisoning.
Researchers have documented an attack technique called FARMA — Forged Amplifying Rationale Memory Attack — that tampers with an LLM agent's stored reasoning traces rather than its factual knowledge. The attack plants fake reasoning histories using language crafted to slip past keyword-based filters, then reinforces those forgeries through self-referential loops that defeat consensus-based defenses. In lab trials across multiple agents and LLM models, FARMA hit a 100% success rate under baseline conditions and broke through two existing defense mechanisms.
This matters because the industry has spent considerable effort securing what AI agents retrieve, while largely ignoring the integrity of what they remember about their own thinking. An agent that trusts a poisoned reasoning history may make decisions that seem internally consistent while being systematically steered by an attacker — a harder problem to catch than a hallucinated fact.
The same paper proposes a defense called SENTINEL, a layered pipeline built around a "Reasoning Guard" that scores candidate memory entries on five weighted signals for signs of forgery. Across 326 benign agent traces, SENTINEL produced no false positives and pushed FARMA's success rate down to 0% in the best conditions. Those are lab numbers, which tend to look cleaner than production does — but the structural approach is worth watching as persistent-memory agents move from research demos into deployed products.