MAFIA Attack Poisons Agent Memory 90.7% of the Time

A new attack on AI agent memory succeeds 90.7% of the time even against systems that actively audit for planted content, per the MAFIA paper (arXiv:2608.03844). That's bad news for any team leaning on audit-based filtering as the main safeguard for what an agent remembers and later acts on.

The method targets two conditions common to real deployments, per the paper: large pools of legitimate memory records and active auditing. Earlier memory-poisoning attacks failed against that same pair. Peak audit detection drops from 83.3% to at most 7.4% once MAFIA runs, per the paper.

One part of the attack, a placement strategy, probes an agent's memory pool and sets a budget for how many malicious entries to inject. It schedules those writes to stay competitive with legitimate records during retrieval.

A second technique, compact factual cloaks, disguises the injected entries as short, plausible facts. The entries keep their malicious effect while matching the semantic similarity scores of real records closely enough to slip past filters built to catch outliers.