If your agent has persistent memory — it writes facts, decisions, or reasoning traces to a store it reads back in a later session — that memory is no longer just something the agent reads. It is something an attacker, or the agent's own drift, can write to. Untrusted content the agent processes today (an email, a tool result, a retrieved document) can plant an entry that survives into every future session and gets treated as trusted state from then on, with no further scrutiny.
"},{"heading":"Short answer","html":"No, not by default. Two independent 2026 papers show current agent memory pipelines are exploitable in different ways: one attack forges the agent's own past reasoning and reaches up to 100% success under baseline conditions; another silently injects poisoned facts or preferences through routine external content and reaches 87.5% end-to-end success against a real coding-agent stack, transferring across architectures and memory backends. A third benchmark shows agents also over-trust their own stored memories over fresh, correct evidence — sycophancy, a failure mode that needs no attacker at all. Only a purpose-built defense layer closes the gap; the defenses these papers test by default (keyword filters, consensus/majority checks) do not.
"},{"heading":"Builder model","html":"Split memory-trust failures into two attacker-controlled classes plus one non-adversarial class:
\nAll three share the same root cause: once something is written to memory, most pipelines read it back as trusted without asking how it got there or whether it still holds.
"},{"heading":"Mechanism","html":"FARMA (Forged Amplifying Rationale Memory Attack) targets reasoning poisoning specifically. It writes a forged reasoning entry using evasive phrasing designed to slip past keyword-based memory filters, then uses self-referential reinforcement — the forged entry cites or echoes itself across turns — to defeat defenses that rely on consensus among multiple memory entries. Because the forgery reads as internally consistent, majority-vote checks see corroboration instead of an anomaly. The paper's own defense, SENTINEL, doesn't rely on keywords or consensus; its Reasoning Guard component structurally analyzes a candidate memory entry against five weighted forgery signals before it is trusted.
\nMemGhost/WhisperBench targets fact and preference poisoning through the agent's normal ingestion path rather than a jailbreak-style prompt. MemGhost is a one-shot payload-generation framework (environment-proxy emulation plus reinforcement learning) that crafts content — for example, an email — designed to be processed by the agent, written into persistent memory without the user noticing, and only exploited in a later, unrelated session. WhisperBench evaluates this end to end across five risk categories and both fact- and preference-style poisoning, and the resulting payloads transfer across agent architectures and memory backends (filesystem-based and Mem0), and keep working against input-level, model-level, and system-level defenses the authors tested.
\nBoth attacks depend on the same structural gap: a write path into long-term memory that treats agent-generated or externally-sourced content as safe to store, and a read path that treats anything already in memory as more trustworthy than it should be. This is the mirror image of the compaction failure mode in does compacting an agent's context put its safety rules at risk? — there, a legitimate constraint gets silently dropped; here, an illegitimate one gets silently added and kept.
"},{"heading":"Evidence","html":"See agent memory for the broader tiered-memory architecture debate, prompt injection for the adjacent single-turn threat model, and does compacting an agent's context put its safety rules at risk? for the mirror-image failure where a legitimate constraint is silently lost instead of an illegitimate one silently kept.
"}],"evidence":[{"id":"farma-sentinel-2026-reasoning-memory-attack","kind":"benchmark-result","tier":"benchmark/result-backed","title":"Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses","note":"Introduces FARMA (Forged Amplifying Rationale Memory Attack), which poisons an agent's remembered reasoning traces rather than its facts: it inserts forged reasoning using evasive language that bypasses keyword-based defenses, then amplifies it through self-referential reinforcement that defeats consensus-based defenses. Attack success reaches up to 100% under baseline conditions across 50 trials. The paper's SENTINEL defense (a Reasoning Guard that scores five weighted forgery signals) reduces attack success to as low as 0%, with no false positives across 326 benign agent traces.","url":"http://arxiv.org/abs/2607.05029v1"},{"id":"memghost-whisperbench-2026-stealth-memory-injection","kind":"benchmark-result","tier":"benchmark/result-backed","title":"When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents","note":"Introduces MemGhost, a one-shot payload-generation framework, and WhisperBench, a 108-case benchmark spanning five risk categories covering both fact and preference poisoning delivered through untrusted external content (such as email) that gets silently written into persistent memory and later reused as trusted state. End-to-end attack success reaches 87.5% against OpenClaw with GPT-5.4 and 71.4% against the Claude Code SDK with Sonnet 4.6 across held-out test cases, and the attack transfers across agent architectures (NanoClaw, Hermes Agent) and memory backends (filesystem, Mem0), remaining effective against the input-level, model-level, and system-level defenses tested.","url":"http://arxiv.org/abs/2607.05189v1"},{"id":"memsyco-bench-2026-memory-sycophancy","kind":"benchmark-result","tier":"benchmark/result-backed","title":"MemSyco-Bench: Benchmarking Sycophancy in Agent Memory","note":"Points out that most memory benchmarks only check whether memories are stored, retrieved, or updated correctly, and proposes five tasks that instead test whether an agent can reject a memory as insufficient evidence, respect its applicable scope, resolve a conflict between memory and objective evidence, track memory updates, and use valid memory for personalization — surfacing sycophancy (an agent over-trusting a stored memory over fresh, correct evidence) as a distinct, non-adversarial memory failure mode.","url":"http://arxiv.org/abs/2607.01071v1"},{"id":"agent-memory-poisoning-editorial-synthesis","kind":"editorial-inference","tier":"editorial inference","title":"LLM Digest synthesis","note":"Persistent agent memory deserves the same threat model as prompt injection: anything written into long-term memory from an untrusted source, or generated by the agent itself, can later be replayed as trusted context, and a reasoning trace is exactly as forgeable as a fact."}],"related_topics":[{"slug":"agent-memory","title":"Agents forget across steps and sessions"},{"slug":"prompt-injection","title":"Untrusted input and tools can hijack an agent"}],"related_playbook_cards":[],"related_storylines":[],"covers_evidence":["farma-sentinel-2026-reasoning-memory-attack","memghost-whisperbench-2026-stealth-memory-injection","memsyco-bench-2026-memory-sycophancy","agent-memory-poisoning-editorial-synthesis"]}