The memory that
wasn't yours.
First surfaced in Tandemly Briefing — July 17, 2026
Penn State researchers found that you don't need to poison what an AI agent remembers. Poisoning how it remembers thinking is both easier and harder to catch. Their attack defeats the two defenses most teams rely on, and their paired defense closes the gap with no false positives on 326 real traces.
Agents remember
how they thought.
Most security work on agent memory focuses on facts: wrong facts inserted, correct facts poisoned. But modern agents also store something else: the reasoning behind their past decisions.
A persistent-memory agent doesn't just remember what happened. It remembers how it reasoned through what happened. That reasoning history: the chain-of-thought entries, the rationales for past tool calls, the explanations the agent wrote for its own decisions, is stored alongside the facts and retrieved as context for future tasks.
The security field mostly hasn't looked at this yet. Prior work on memory poisoning attacks focuses on inserting false factual claims into the memory store. If the agent remembers that "the server was patched on March 3rd" when it wasn't, that's a factual poisoning attack. Defenses for this category are reasonably well developed: keyword filters to catch suspicious content, consensus-deviation checks that flag entries which diverge from most retrieved memories.
What no one had fully examined was what happens when the attacker targets the reasoning layer instead. If the agent remembers reasoning its way through a validation step that never happened, the memory looks legitimate. It doesn't contain suspicious keywords. It may appear consistent with other entries. And it can shape every downstream decision that relies on whether that validation step was done.
An agent that has "remembered" completing a safety check it never ran will skip that check on the next task. Not because the attacker overwrote a fact, but because the attacker forged a reasoning trace. The distinction matters because the defenses for fact poisoning are almost entirely irrelevant here.
Two moves,
one attack.
FARMA (Forged Amplifying Rationale Memory Attack) operates in two stages. The first stage gets the forged entries into memory. The second stage makes them look credible to any defense checking for outliers.
The first stage is injection. The attacker inserts forged reasoning traces into the agent's memory store. These traces are written to avoid triggering keyword-based detection: they use neutral, evasive phrasing that sounds like legitimate agent output. There are no red flags. The content reads like a real reasoning step the agent might have produced itself.
The second stage is amplification. This is the harder-to-counter move. The attacker adds self-referential reinforcement entries: fake memories that reference the original forged trace and build a consistent internal narrative around it. The result is that when a consensus-deviation defense checks whether a retrieved memory aligns with the others in the store, the forged entries look like the consensus. Defenses like A-MemGuard, which flag anomalous or deviant memories, see nothing unusual.
To counter FARMA, the researchers built SENTINEL: a five-layer defense pipeline with a Reasoning Guard at its center. Instead of scanning for suspicious keywords or checking statistical consensus, the Reasoning Guard analyzes the structural properties of each reasoning trace before it enters memory. Five weighted signals probe the shape of the trace itself. One of those signals penalizes implausible perfect-consistency: a reasoning trace that claims to have done everything correctly with no uncertainty, no backtracking, and no caveats, is statistically unusual for genuine agent output and structurally consistent with a forged entry that was written to appear legitimate.
The contrast in approach matters. FARMA is designed to look correct from the outside. SENTINEL asks whether the trace has the internal texture of something an agent actually produced under real conditions.
Real agent reasoning carries entropy: false starts, uncertainty markers, conditional hedges. A forged trace written to avoid keyword triggers and mimic consensus doesn't carry that entropy naturally. It over-confirms. Structural analysis of the trace catches what content analysis misses.
The numbers
are stark.
FARMA achieves perfect attack success against the defenses most teams deploy. SENTINEL closes the gap to zero with no false positives. The gap between the two is large enough that the paper makes the threat concrete rather than theoretical.
Any sufficiently aggressive filter can block attacks. The harder question is whether the filter also blocks legitimate agent outputs. Running SENTINEL against 326 benign traces with zero false positives is the result that matters most for production use. A defense that blocks attacks and also breaks the agent's normal reasoning memory is not deployable.
The researchers explicitly separate the two numbers: attack success and false positive rate. That's the negative control the field usually skips when reporting defenses.
The evaluation covers three domains and three models, which is a reasonable range but not exhaustive. SENTINEL's five signals were developed and tested against FARMA specifically. It is plausible that future attack variants could be designed to appear structurally legitimate. The false positive count of zero is encouraging but represents a single study; replication across more diverse agent workloads would strengthen the claim. The researchers are explicit about the scope rather than overstating generalizability.
What changes
for builders.
The core shift this paper demands is a mental model update. If you have been thinking about agent memory security as a problem of bad facts getting in, you need to start thinking about it as a problem of bad reasoning getting in too.
Where to go
from here.
Concrete steps for teams who want to act on this research before waiting for industry tooling to catch up.