First reported substack.com
Research · latest
First reported · updated · 2 reports arxiv.org
Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
Researchers at Penn State introduce FARMA (Forged Amplifying Rationale Memory Attack), which poisons an LLM agent's remembered reasoning traces rather than its factual knowledge, using evasive language to bypass keyword filters and self-referential reinforcement to defeat consensus-based defenses, achieving up to 100% attack success including against A-MemGuard. They also propose SENTINEL, a layered defense whose Reasoning Guard structurally analyzes memory entries for forgery, reducing attack success to as low as 0% with no false positives across 326 benign traces. Details →First reported mindgard.ai
Bypassing ChatGPT Image Safeguards Through Memory Manipulation
Mindgard research demonstrates bypassing ChatGPT's image-generation safeguards through manipulation of custom memory and system/instruction context, inducing policy-inconsistent output including sexualized images of fictitious and real people. The techniques exploit the bio tool, model set context, and image routing/filtering pipeline without accessing model weights, and were disclosed to OpenAI prior to publication. Details →First reported arxiv.org
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
InjecMEM, described in a paper by researchers from Shanghai Jiao Tong University and Ant Group, is a memory-injection attack that plants hidden instructions in an LLM agent's persistent memory with a single interaction and no read/edit access to the memory store. Using a retriever-agnostic anchor plus a gradient-optimized adversarial command, it steers later responses on a target topic, achieving up to 35.4% retrieval success and 76.6% attack success on MemoryOS while leaving non-target queries unaffected; code is published on GitHub. Details →First reported arxiv.org
MAPLE-Guard: Memory-Aware Link EnforcementAgainst Memory-Link Poisoning in Multi-Agent Systems
MAPLE-Guard is a defense presented in an arXiv paper against memory-link poisoning in LLM-based multi-agent systems, where a single poisoned memory write can be retrieved, promoted into shared memory, and reused by agents that never saw the original attack. The guard places gates at write, retrieval, promotion, and cross-agent reuse, reportedly lowering attack success rate from 38.2% to 0.9% on LongMemEval and 34.7% to 0.2% on AppWorld, with code released on GitHub. Details →First reported aclanthology.org
BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks
BlindGuard is a research paper (ACL 2026) proposing an unsupervised defense for LLM-based multi-agent systems (MAS) against the 'propagation vulnerability,' where malicious agents distort collective decision-making through inter-agent interactions. The authors argue existing supervised detection methods are impractical because they rely on labeled malicious agents, and present a method that safeguards MAS under unknown attacks without such labels. Details →First reported arxiv.org
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
The arXiv paper "Hidden in Memory: Sleeper Memory Poisoning in LLM Agents" (2605.15338), explained in a companion Medium write-up, demonstrates a delayed attack in which adversarial content in a document, webpage, or repository causes a stateful LLM assistant to store a fabricated memory about the user that re-emerges across future sessions. Across tested assistants, poisoned memories were written up to 99.8% of the time on GPT-5.5 and 95% on Kimi-K2.6, and among successful retrievals they steered attacker-intended agentic actions in 60–89% of evaluations; the authors release code on GitHub. Details →First reported arxiv.org
When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems
Researchers at Worcester Polytechnic Institute presented AcMAS, an activation-based framework for detecting stealthy malicious behaviors in LLM-based multi-agent systems (MAS), at ICML 2026 (arXiv:2607.06807). AcMAS analyzes internal reasoning states in the activation space of local agents to detect compromised agents without relying on explicit interaction graphs, reporting large F1 improvements over graph-based baselines in both synchronous (0.94 vs 0.72) and asynchronous (0.93 vs 0.38) settings, and can help restore compromised agents rather than isolating them. Details →First reported theregister.com
Prompt injection isn't the bug, AI agent frameworks are
Check Point researchers Yarden Porat and Shahar Tal disclosed 11 vulnerabilities across major AI agent frameworks (LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, Google ADK), arguing that the real risk is how frameworks handle prompt injection rather than injection itself. Their findings include classic flaw classes—insecure deserialization, SSRF, path traversal, use-after-free—such as a critical checkpoint deserialization bug in Microsoft Agent Framework that allowed remote code execution via poisoned agent state; Microsoft paid a $10,000 bounty and fixed it. Details →First reported arxiv.org
Forensic Trajectory Signatures for Agent Memory Poisoning Detection
The paper 'Forensic Trajectory Signatures for Agent Memory Poisoning Detection' by Jun Wen Leong identifies a behavioral invariant in LLM agents under persistent memory poisoning: successful attacks require calling memory_recall_fact before email_send_email. A rule and Random Forest classifier over trajectory features achieve high AUC (up to 0.99) across 9 models, but a preregistered follow-up (N=4,360, 13 models) reveals benign memory-grounded sends produce the same signature, causing high false positives; the recall_before_send pattern is an attack precondition rather than a maliciousness predicate, requiring recipient-metadata gating to restore separation. Details →First reported arxiv.org
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
Researchers introduce GhostWriter, a memory-poisoning attack against tool-using personal LLM agents with long-term memory, operating in an injection phase (a hidden payload sent to the agent) and an activation phase (the poisoned memory being retrieved). The paper reports near-universal ~98% injection and ~60% activation rates against state-of-the-art agents, and proposes a defense, Agentic Memory Sentry (AM-Sentry), using a memory-saving policy and a memory-retrieval screen to reduce success while preserving utility. Details →First reported aicerts.ai
New MCP Benchmark Highlights Server Drift Dangers
An MCP Benchmark study scanned 10,831 Model Context Protocol servers and linked poor tool-description quality ("description smells" like missing return fields, wrong parameter semantics, and duplicate tool names) to measurably higher exploitation rates, with servers rated 'poor' tripling successful-attack probability. The research characterizes 'MCP drift' — unreviewed post-deployment changes to tool descriptions, parameters, or capabilities — as a live supply-chain threat, sometimes via benign onboarding followed by malicious rewrites weeks later, and notes simple 27-line mitigations eliminated high-severity findings in lab tests. Details →First reported arxiv.org
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
A paper by Yimeng Chen, Nathanaël Denis, Roberto Di Pietro and Jürgen Schmidhuber formalizes 'self-state attacks,' in which a self-hosted AI agent is compromised by corruption of its own memory and configuration files via legitimate OS system calls. The authors characterize a four-axis attack space rendered as a 23-cell matrix with 43 concrete file operations, evaluate a layered OS-level defense against injected activity traces, and find that four attack cells (concentrated on memory-file writes) remain structurally indistinguishable at the OS level. Details →First reported arxiv.org
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
"Bad Memory" is a research paper studying prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace, evaluating Anthropic Claude Code and OpenAI Codex across four models. The authors find that while it is hard to make an agent overwrite its own memory files using untrusted external content, payloads already planted in persistent memory files can successfully compromise current and future sessions, with attack success and persistence varying by system, model, and adversarial goal. Details →First reported aclanthology.org
Data Exfiltration via Backdoored Tool Use
Researchers present Back-Reveal, a data exfiltration attack that embeds semantic triggers into fine-tuned tool-use LLM agents; when triggered, the backdoored agent invokes memory-access tool calls to retrieve stored user context and covertly transmits it to an attacker-controlled server disguised as legitimate retrieval/search API requests. The paper shows multi-turn interaction amplifies leakage, as attacker-controlled retrieval responses steer subsequent agent behavior to induce cumulative disclosure, and evaluates defenses like NeMo Guardrails and LLM Guard as targets. Details →First reported icml.cc
ICML Poster An Empirical Study of Memory Poisoning Defenses for LLM Agents
An ICML 2026 poster titled "An Empirical Study of Memory Poisoning Defenses for LLM Agents" presents research evaluating defenses against memory poisoning attacks on LLM agents, with an associated code artifact (AMemGuard on GitHub). Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector