FARMA: How Forged Memory Attacks Compromise AI Agents

As enterprise engineering teams equip autonomous AI agents with persistent vector storage and long-term reflection logs, a critical security vulnerability has emerged: memory forgery. Unlike traditional prompt injection that targets real-time context windows, newly uncovered research demonstrates how attackers can poison an agent’s self-reflection buffers and trick it into accepting hostile actions as historical best practices.

Key Takeaways

Targeting Reasoning Over Data: The newly identified FARMA (Forged Amplifying Rationale Memory Attack) threat model targets an agent’s historical reasoning logs rather than static data retrieval.
The Amplification Loop: Attackers inject fake precedent entries into long-term memory; over multi-step workflows, agents cite their own poisoned memories to justify bypassing security protocols.
Persistent Exploitability: Poisoned memories persist across session boundaries, enabling subversion of enterprise AI workflows without requiring continuous re-injection.
Structural Defense Requirements: Defending against memory forgery requires runtime cognitive verification, such as structural trace analysis and gear-based execution boundaries.

Beyond RAG Poisoning: The Architecture of Memory Forgery

Most enterprise AI security discussions focus on Retrieval-Augmented Generation (RAG) poisoning—protecting external knowledge bases from containing malicious documents. However, published research in arXiv:2607.05029 highlights a far more sinister attack vector: Forged Amplifying Rationale Memory Attacks (FARMA).

Autonomous agents rely on episodic memory and self-reflection buffers (such as decision logs, past execution traces, and self-correction notes) to accomplish long-horizon tasks. FARMA exploits this trust model by injecting synthetic decision logs designed to mimic the agent’s own internal monologue.

[Attacker Payload] ──> [Synthetic Reflection Entry] ──> [Episodic Vector Store]
                                                              │
                                                              ▼
[Subsequent User Task] <── [Cites Synthetic Precedent] <── [Agent Memory Recall]

When an agent encounters a complex problem, it retrieves past rationales to determine its next action. By treating synthesized reflection entries as verified precedent, the agent willingly executes unsafe operations under the belief that it previously validated them.

How FARMA Operates: Two-Phase Exploitation

The mechanics of a FARMA exploit depend on a feedback mechanism built directly into modern agentic frameworks. The attack occurs across two distinct phases:

Phase 1: Precedent Injection

The attacker introduces seed entries into the agent’s persistent memory store. These entries are structured identically to valid self-reflections, containing synthetic key-value pairs of rationales, risk assessments, and tool authorization confirmations.

Phase 2: Autonomous Amplification

During standard operation, the agent performs vector similarity searches over its memory store to solve new tasks. Upon retrieving the forged rationale, the agent incorporates the malicious logic into its active context, citing its “past experience” as justification to execute privileged system calls or bypass safety guardrails.

Because the exploit relies on the agent’s internal reasoning loop, external security layers often fail to recognize the threat. As we analyzed in our breakdown of Agentjacking and MCP Vulnerabilities, traditional perimeters cannot parse mutating semantic logic operating inside trusted API connections.

Enterprise Risk: Why Memory Attacks Are Persistent Threats

Traditional prompt injections are ephemeral—once the session terminates or the context window clears, the injection disappears. FARMA transforms prompt injection into a persistent zero-day vulnerability across enterprise infrastructure.

+------------------+-----------------------------------+------------------------------------+
| Threat Vector    | Execution Context                 | Persistence Horizon                |
+------------------+-----------------------------------+------------------------------------+
| Direct Injection | Immediate User Prompt             | Single Turn                        |
| Indirect RAG     | External Document Retrieval       | Until File Removal                 |
| FARMA (Memory)   | Internal Reflection & Action Logs | Cross-Session / Persistent Vector  |
+------------------+-----------------------------------+------------------------------------+

When autonomous agents are deployed across critical business systems like Jira, Salesforce, and developer IDEs, a single memory poisoning attack can corrupt all subsequent agent instances sharing that memory pool. This structural vulnerability aligns directly with risks highlighted in the OWASP Top 10 for Agentic Systems.

If left unmitigated, corrupted agents can silently escalate permissions, exfiltrate sensitive environment variables, or execute arbitrary code without raising suspicious system events.

Mitigating Memory Forgery: Defensive Frameworks

Securing persistent AI memory requires shifting from static boundary checks to continuous cognitive verification. Implementing the following defensive layers helps isolate and neutralize memory attacks:

1. Structural Rationale Verification (SENTINEL)

Researchers proposing FARMA developed SENTINEL, a defense pipeline that performs structural graph analysis on retrieved memories. By comparing historical execution traces against verified signature trees, SENTINEL detects synthetic anomalies before rationales enter the active prompt.

2. Runtime Cognitive Guardrails

Static boundary checks are blind to internal reasoning exploits. As outlined in our research on the Agent-Native Immune System (ANIS), agents must incorporate runtime cognitive monitors (L0–L5 layers) to inspect execution traces and verify that memory recalls conform to hard safety invariant boundaries.

3. Gear-Based Execution Controls

To prevent autonomous agents from escalating privileges based on memory precedent, enterprise architectures must enforce runtime governance. Frameworks such as Managed Autonomy (arXiv:2607.00334) implement gear-based state transitions ($\text{G}{\text{obs}}$ through $\text{G}{\text{exec}}$), requiring explicit human validation when agents attempt high-impact state changes.

Additionally, organizations evaluating multi-agent workloads should benchmark their setups against standard threat models, as detailed in our guide on Securing AI Agents with AgentRedBench.

Final Thoughts: Securing the Agent’s Mind

The emergence of FARMA signals a critical evolution in AI cybersecurity. As agents transition from stateless conversationalists to long-horizon autonomous operators with long-term memory, security models must evolve in tandem.

Enterprise leaders and AI architects cannot assume internal reflection logs are immutable. Protecting the next generation of autonomous workforces requires treating agent memory with zero-trust principles—cryptographically verifying reasoning traces, enforcing runtime cognitive governance, and sandboxing privileged execution environments.