First reported arxiv.org
Research · latest
First reported arxiv.org
Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses
Researchers at Penn State introduce FARMA (Forged Amplifying Rationale Memory Attack), which poisons an LLM agent's remembered reasoning history rather than its factual knowledge, inserting forged reasoning traces with evasive language that bypass keyword filters and self-referential reinforcement that defeats consensus-based defenses like A-MemGuard, achieving up to 100% attack success. They also present SENTINEL, a layered defense pipeline whose Reasoning Guard structurally analyzes entries using five weighted signals, reducing FARMA's success rate to as low as 0% with no false positives across 326 benign traces. Details →First reported arxiv.org
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
"Bad Memory" is a research paper studying prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace, evaluating Anthropic Claude Code and OpenAI Codex across four models. The authors find that while it is hard to make an agent overwrite its own memory files using untrusted external content, payloads already planted in persistent memory files can successfully compromise current and future sessions, with attack success and persistence varying by system, model, and adversarial goal. Details →First reported icml.cc
ICML Poster An Empirical Study of Memory Poisoning Defenses for LLM Agents
An ICML 2026 poster titled "An Empirical Study of Memory Poisoning Defenses for LLM Agents" presents research evaluating defenses against memory poisoning attacks on LLM agents, with an associated code artifact (AMemGuard on GitHub). Details →First reported koreshield.ai
Reproducing an Indirect Prompt Injection Against a RAG Pipeline
A Koreshield write-up reproduces an indirect prompt injection against a RAG customer-support pipeline, where a poisoned knowledge-base document (doc-002) contains a bracketed fake 'system note' instructing the model to dump all retrieved documents and exfiltrate internal tokens with an 'EXFIL::' marker while hiding the action. The author provides runnable code, a public GitHub harness (UncleTeslim/prompt-injection-repro), and real model logs demonstrating the attack against a local Llama3-8B model. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector