Current memory tools can pass a poisoned run on. Procedural memory can stop it (github.com)