CURRENT
A journal for living in the agentic age
Reading List
Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice.
Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice.
An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer.
An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer.
Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted.
These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break.
Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted.
These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break.
Agent memory systems are reliable at storing and returning text. But the text is only part of what makes stored information trustworthy. At write time, metadata travels alongside it: who produced it, where it came from, whether anyone verified it, when it was recorded, what conditions it applied to.
Between write and retrieval, that metadata gets stripped away. Chunking removes some. Embedding discards more. Consolidation, where multiple entries get merged into compressed summaries, tends to finish the job. What comes back is content without the surrounding context that would tell you whether to trust it or how narrowly to apply it. These are the specific dimensions where that loss occurs.
Agent memory systems are reliable at storing and returning text. But the text is only part of what makes stored information trustworthy. At write time, metadata travels alongside it: who produced it, where it came from, whether anyone verified it, when it was recorded, what conditions it applied to.
Between write and retrieval, that metadata gets stripped away. Chunking removes some. Embedding discards more. Consolidation, where multiple entries get merged into compressed summaries, tends to finish the job. What comes back is content without the surrounding context that would tell you whether to trust it or how narrowly to apply it. These are the specific dimensions where that loss occurs.
Past Articles
An FDA-authorized pathology tool requires the doctor to record a diagnosis before the AI reveals its own. Commit first, ...
A survey of 86 deployed agent systems found that 74% use human verification to ensure quality. None of them compared out...
For years my entire toolkit for identifying a crawler was a user-agent string, an IP range, and a reverse DNS record tha...
Site operators are writing robots.txt rules against crawlers that were switched off years ago, and against crawlers nobo...
