Agent Builder Foundations

No, not by default. 2026 benchmarks show three ways memory goes wrong:

• Forged reasoning: FARMA reaches up to 100% attack success under baseline conditions.
• Poisoned facts via routine content: MemGhost reaches 87.5% end-to-end success against a real agent stack and transfers across architectures and backends.
• Sycophancy: agents over-trust stored memories over fresh, correct evidence, with no attacker involved.

Keyword filters and consensus checks do not close the gap; only purpose-built defenses tested so far do.

Memory-trust failures come in three classes:

• Fact or preference poisoning. Untrusted content the agent ingests is written to memory and reused as ground truth. The attacker never touches the agent, only what it reads.
• Reasoning poisoning. The attacker forges the record of *why* the agent decided something, so later self-consistency or majority checks see corroboration instead of an outlier.
• Sycophancy (no attacker). The agent weights a stored memory over better, current evidence because retrieval surfaced it and nothing forces re-verification.

The shared root cause: once something is in memory, most pipelines read it back as trusted without asking how it got there or whether it still holds.

Reasoning forgery beats surface defenses. A forged reasoning entry phrased evasively slips past keyword filters. If it cites or echoes itself across turns, consensus checks count it as agreement. FARMA uses both. The SENTINEL defense instead scores each candidate entry against structural forgery signals before it is trusted.

Poisoning rides the normal ingestion path. MemGhost needs no jailbreak prompt. It crafts content, such as an email, that the agent processes, writes to memory without the user noticing, and acts on in a later, unrelated session. On WhisperBench the payloads transfer across agent architectures and memory backends and survive the defenses tested, including 71.4% success against the Claude Code SDK.

Both attacks exploit one gap. The write path stores agent-generated or external content as safe, and the read path treats anything already stored as more trustworthy than it should be.

It mirrors compaction failure. In does compacting an agent's context put its safety rules at risk?, a legitimate constraint is silently dropped. Here, an illegitimate one is silently added and kept.

• Treat every memory write path as untrusted input. Tool outputs, retrieved documents, parsed emails, and the agent's own reasoning summaries all need prompt-injection-level scrutiny before a future session trusts them.
• Do not rely on keyword filters or consensus checks alone. FARMA is built to beat both. For reasoning-forgery defense, score entries structurally, as SENTINEL's Reasoning Guard does.
• Run an adversarial replay test on your real ingestion path. Feed attacker-controlled content through your actual email, tool, and document ingestion and check whether it lands unnoticed in the persistent store. Vendor agent tooling does not protect memory writes by default.
• Test sycophancy separately. Give the agent a stored memory that conflicts with correct, fresh evidence and check whether it defers to the memory. An adversarial-only suite will not catch this.

• Trusting a memory entry because the agent wrote it, without checking how it got there.
• Defending memory with keyword filters or consensus checks only.
• Assuming single-turn prompt-injection defenses cover memory, which is written once and replayed every session.
• Never testing whether attacker content can reach persistent storage through real ingestion.
• Treating sycophancy as out of scope because it is not an attack.

See agent memory for tiered-memory design, prompt injection for the single-turn threat model, and does compacting an agent's context put its safety rules at risk? for the mirror-image failure.