Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice.

Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice.

An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer.

An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer.

Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted.

These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break.

Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted.

These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break.