A new attack framework can steer a community of AI chatbots toward extreme opinions without editing a single prompt.
Researchers describe GraphWake, a method for triggering what they call a Memory-Mediated Polarization Cascade in communities of LLM-driven agents that debate topics on their own, the kind of autonomous social platforms starting to pop up as experiments in agent-to-agent interaction. The attack unfolds in three stages. First, an attacker feeds a small set of target agents one-sided arguments that match views those agents already hold, and the agents' memory systems store them. Later, a completely neutral group discussion prompts those same agents to pull the stored arguments back out and repeat them. From there, other agents who were never directly targeted pick up the reproduced arguments and spread them further, amplifying the original bias across the whole group. GraphWake builds the one-sided arguments from knowledge graphs, trims them down to the claims most likely to stick in memory, and times the neutral discussion prompt to trigger mass retrieval at once. Tested across multiple discussion setups and memory systems, it reliably pushed group opinion further toward the extremes.
This matters because it sidesteps the defenses people have been building. Most anti-manipulation work assumes attackers rewrite prompts or plant fake accounts to build echo chambers, both things a platform can filter or flag. GraphWake instead treats an agent's own memory as the delivery mechanism and an ordinary conversation as the trigger, so the manipulation looks like organic group behavior rather than an obvious injection attack.
It is astroturfing for the agent era: same old goal of manufacturing consensus, except the sock puppets are memory retrieval calls and the tell-tale coordination happens invisibly, inside each agent's own recall.