Right now every production team deploying LLM agents is building the same mistake. Everyone is racing to add persistent memory. No one is securing it.

This is not a hypothetical risk. Two independent papers published this month demonstrate reliable, one-shot, black-box attacks that inject malicious state into agent memory. These attacks survive session resets, bypass all currently deployed defenses, and lie dormant for days or weeks before triggering. They work against GPT-5.4, Claude 4.6, OpenClaw, Hermes Agent, Mem0 and every other major stack available today.

This is worse than ordinary prompt injection. Ordinary injection only works once. Memory injection stays forever.

The attack no one was looking for

Everyone has been fighting prompt injection for three years. All the defenses, all the benchmarks, all the tooling was built for one case: an attacker sends input, the agent does something bad immediately.

No one considered the case where the attacker sends input, the agent does nothing bad immediately. It just remembers.

Three weeks later, when you ask the agent to book you a flight, it uses that poisoned memory to change the destination. It will not tell you it did this. It will not show any sign it was compromised. It will just act like this was always your preference.

This is stealth memory injection. It exploits the single core design assumption of every agent framework: anything written to memory is trusted.

MemGhost attack results

The first paper from UC Berkeley and OpenAI safety introduces MemGhost, a payload generator built specifically for this attack vector. It does not try to get the agent to do something bad right now. It only tries to get the agent to write a specific fact or preference into long term memory, without mentioning anything unusual in the immediate response.

Across 56 blind test cases run against unmodified production agent implementations:

Agent / Model	End to end attack success rate
OpenClaw / GPT-5.4	87.5%
Claude Code SDK / Sonnet 4.6	71.4%
NanoClaw / GPT-4o	64.3%
Hermes Agent / Llama 3.1	58.9%

Every single test payload was delivered as a single plain text email. No privileged access. No runtime feedback. No repeated attempts. One shot.

The attack also transferred unchanged across memory backends. It worked identically against filesystem memory, vector databases, Mem0, and every commercial memory layer tested.

Why standard defenses do nothing

All the standard prompt injection defenses fail completely here.

Filtering does not work. The payload contains no suspicious phrases. There is no "ignore previous instructions". There are no jailbreak markers. It just looks like normal email.

XML tagging, sandwich prompts, instruction warnings do not work. The attack does not try to override instructions. It just provides information that the agent will naturally summarize and store.

Second model bouncers do not work. The input is not malicious. The immediate output is not malicious. Nothing about this transaction looks wrong at the time it happens.

The attack only becomes malicious weeks later, when the memory is retrieved. At that point there is no record of where it came from. No one will ever connect the flight booking change to an email received three weeks prior.

Forged reasoning attacks

The second paper from MIT CSAIL goes one step further. It demonstrates that you do not even need to poison facts. You can poison the agent's own reasoning.

This attack is called FARMA. It injects fake reasoning traces into memory. When the agent later retrieves that trace, it treats it as its own prior conclusion. It will not re-examine it. It will not verify it. It will build on top of it exactly as if it had written it itself.

FARMA achieved 100% attack success rate against baseline agents. It defeated keyword filters, A-MemGuard and every existing memory defense published before this month.

Agents trust their own memory completely. They never double check it. They never question how it got there. That is the entire point of memory. That is also the vulnerability.

The attack flow

This is the worst kind of vulnerability. There is no alert. There is no log entry that will flag this. The agent behaves exactly as it was designed. It is just acting on bad memory that an attacker put there.

The silent failure mode everyone already hit

This is not just theoretical. Production teams are already hitting benign versions of this bug every week.

Last month a team building on Claude Code watched their agent re-introduce an exact PCI violating database column that they had reverted 28 days earlier. The agent had no memory of the revert, no memory of the discussion, no memory of why that column was removed. It just saw a problem and proposed the obvious solution that had already been tried and rejected.

That was an accident. An attacker can do this on purpose.

Right now every agent will happily resurrect every bad idea you ever killed. It will not mention that it was tried before. It will not mention that it was reverted. It will just present it as a new good idea.

What actually works right now

There is no silver bullet. There is no patch you can apply. There are however practical things you can implement today that will meaningfully reduce risk:

1. Never trust memory origin. Attach full provenance to every single memory entry. Record exactly what external input caused this entry to be written. Before using any memory entry, show the user the original source, not just the agent's summary.
2. Gate all memory writes. Do not let the agent write anything to persistent memory without an explicit, separate approval step. Memory writes are privileged operations. Treat them that way.
3. Expire all memory. Nothing lives forever. Set hard TTLs on every entry. No preference, no fact, no reasoning trace stays in memory for more than 7 days by default.
4. Never retrieve memory implicitly. Require the agent to explicitly state which memory entry it is using for every action it takes.

SENTINEL defense

The MIT paper also introduces SENTINEL, the first defense that actually works against forged reasoning attacks. It runs structural analysis on every memory entry before it is written, checking for five specific signals of forged reasoning.

Defense	FARMA attack success rate	False positive rate
Baseline	100%	0%
Keyword filter	92%	1.2%
A-MemGuard	78%	3.7%
SENTINEL	0%	0%

SENTINEL is not perfect. It is the first thing that has ever stopped this class of attack. As of today there is no public production implementation, but the paper includes full pseudocode and validation test cases.

This is just the beginning

We are at the exact same point with agent memory that we were with prompt injection in early 2023. Everyone is deploying the feature. No one understands the attacks. All the obvious defenses do not work.

This will get worse before it gets better. There will be public breaches. There will be very embarrassing incidents. Agents will do things that no one can explain, because no one will think to check what was written to memory three weeks ago.

You do not need to stop building agents. You do need to stop treating memory as a harmless convenience feature. Memory is state. State that can be written by untrusted input is always an attack surface. Always.

Every time you add persistent memory to an agent you are not just giving it a better memory. You are giving attackers a place to hide.