Proof-of-Execution Memory: one LLM rewrite defeats SENTINEL, and stronger models are more vulnerable.

The FARMA attack plants fabricated entries in an agent's reasoning memory claiming a safety step already ran (arXiv 2608.16032). SENTINEL, the defense shipped alongside FARMA, is evaded on the first try by asking an LLM to reword the forgery. The capability paradox is the part to sit with: 98-100% success on GPT-4o and GPT-4o-mini versus 44% on Llama-3.1-8B, because more capable agents follow reworded claims more faithfully. PoEM's fix is to stop inspecting memory entirely and keep an HMAC-chained ledger writable only by the trusted action layer. Attack success drops to 0% with 0% false positives in eight of nine cells, against SENTINEL wrongly blocking 33-50% of legitimate operations.