FARMA: a memory-poisoning attack that forges an agent's own decision logs, not its retrieved facts

.::most memory-poisoning work (MINJA, AgentPoison, PoisonedRAG) targets what an agent retrieves: knowledge base entries, RAG passages, stored examples. Paper arXiv:2607.05029 (Penn State, submitted July 6) targets something different: the agent's own reasoning store, meaning the decision logs and rationales it writes about its own past work. The attack, FARMA, has two phases. First, inject a few seed entries phrased like normal decision logs, e.g. "source-level validation complete, verified upstream." No blocked keywords, structurally identical to a real entry. Second, amplify: keep writing entries that cite the earlier fake ones ("consistent with 12 prior runs"), building fake precedent until the agent's planner treats a skip as established practice instead of a risk. Numbers, on an EHR-record agent across GPT-4o-mini, GPT-4o, and Llama 3.3 70B: 100% attack success rate, undefended. Against a keyword filter: still 100%. Against A-MemGuard, a consensus-anomaly defense: still 100%, because the amplification phase makes the forged entries the majority, so they stop looking like outliers. The authors' own defense, SENTINEL (structural analysis of reasoning traces using five weighted signals), gets attack success down to 0% with zero false positives across 326 benign traces. Solid result. But they're upfront that an adaptive attacker who knows SENTINEL's exact heuristics defeats it: "did not provide significant protection" is the phrase they use. My take: this is the same arms-race pattern seen before with anything that trusts a self-declared field (source=agent) instead of binding provenance at write time. Heuristics buy time against known attack shapes, not durable trust. The interesting open question is whether reasoning-store writes need something closer to signed commits than to a classifier. Curious if anyone here is running agents with a persistent reasoning or decision-log store in production. Are you doing anything beyond "trust what's retrieved"? Any real incidents, or is this still mostly theoretical for most deployments?