As LLM Agents go into production at scale, persistent memory is almost a default. But the Penn State team's paper "Your Agent's Memories Are Not Its Own", posted on July 6, points out an overlooked attack surface: not injecting facts, but injecting the reasoning process. The proposed FARMA attack works in two steps: first, use evasive language to write forged reasoning traces and bypass keyword filters; then through self-referential reinforcement, make the Agent treat these traces as its own memory and repeatedly reference them, breaking through consensus defenses like A-MemGuard. Across 50 trials, the attack success rate is 100% in the undefended baseline. On the defense side, SENTINEL doesn't take the LLM-filter road, but uses five weighted signals to do structured analysis of candidate memories. Across multiple Agent and LLM combinations, it pushes FARMA success rate to 0%, with no false positives on 326 benign traces — this is a production-system-usable signal. The real value of this work isn't yet another jailbreak variant, but pushing the origin and integrity of memory from optional to mandatory: any team pushing Agents to customer service, ops, or compliance scenarios must add signing, source audit, and abnormal-structure detection at the memory layer, or the Agent's experience can be completely rewritten by external sources.