The documented attacks, incidents, and regulations Memora closes.
Multi-agent security is now its own discipline — memory poisoning, self-replicating AI worms, rogue agents, and cascading inter-agent failure. Each item below is a real, published source. Memora is the memory-integrity layer that neutralises the shared-state half of the problem.
OWASP ASI06 · 2026
State Vector Tampering
A single poisoned write silently corrupts every agent that reads shared memory — and, unlike a one-shot prompt injection, it persists across sessions. Agent Security Bench measured an 84% average attack success rate; MINJA reports >95% injection success against production agents.
How Memora closes it: Every write is Ed25519-signed and attributable to a node; the OR-Set CRDT cannot fork, and ACFA multi-Krum rejects poisoned contributions from the agreed state. Geometric outliers are filtered; values within the honest statistical spread are bounded, not eliminated (see paper §7.1).
Source: OWASP Top 10 for Agentic Applications (2026) →Federated learning · model poisoning
Gradient / Update Poisoning
In federated or multi-node training, a malicious client submits crafted gradient or model updates to skew the aggregated model — and floating-point aggregation can itself fork the result across heterogeneous silicon before any attacker acts.
How Memora closes it: ACFA multi-Krum rejects updates outside the honest geometric spread, G-Set Exclusion convicts an equivocating key, and Fixed-Point Integer Arithmetic (Q16.16) makes the aggregate byte-identical across ARM, x86, and GPU — no silent fork.
Source: ACFA — coordinator-free Byzantine aggregation (arXiv:2607.10305) →Incident · Morris-II worm
Self-replicating prompt worms & cascading failure
A zero-click adversarial prompt cascades across a multi-agent network — each infected agent's output is trusted as the next agent's input, turning one compromise into a swarm-wide breach (OWASP ASI08).
How Memora closes it: One compromised agent is mathematically unable to move the agreed aggregate. The cascade is contained — blast radius bounded to the attacker's own node, which is then convicted.
Source: Morris-II, Cornell Tech / IBM →OWASP ASI10 · 2026
Byzantine Endpoint Equivocation
An agent that double-signs or acts maliciously inside the swarm is still treated as a trusted peer by every other agent.
How Memora closes it: G-Set equivocation proofs convict a double-signing key automatically and evict it from the aggregate — a self-authenticating proof, durable across restarts, that anyone can verify.
Source: OWASP GenAI Security Project →Root cause · inter-agent trust
“Internal agent comms are trusted”
Multi-agent systems are built assuming messages between agents are secure and trustworthy — the exact assumption inter-agent attacks and AI worms exploit (OWASP ASI07).
How Memora closes it: Memora removes the assumption entirely: no write is trusted on faith — each is signed, verified, and Byzantine-tolerated before it is allowed to touch shared state.
Source: Multi-Agent Risks from Advanced AI (arXiv:2502.14143) →Regulation · EU AI Act
Art. 12 & 13 — traceability & tamper-proof logging
From 2 August 2026, high-risk AI must automatically log agent identity and every action with cryptographic tamper-evidence and output verification. Non-compliance: up to €35M or 7% of global turnover.
How Memora closes it: Every op is signed, attributable to a node, and exactly replayable from an append-only log with byte-identical roots — a compliance-grade, tamper-evident audit trail by construction.
Source: EU AI Act, Articles 12 & 13 →Memora contains, attributes, and evicts — it does not replace input filtering at the model boundary. It is the layer that makes a compromised agent unable to fork, poison, or silently corrupt the rest.