There is a question I ask early in an agent teardown, and it is the one that most reliably produces silence. Not what can this agent do, which everybody has an answer to, and not what data can it reach, which is usually documented somewhere. The question is: when did anyone last read what this agent remembers? Not the logs of what it did — the store it carries into every new conversation, the thing that makes it feel like it knows you. Who has looked inside it, what is in there, and where did each of those things come from?

The answers cluster. Sometimes it is nobody, because the memory is a managed feature of a platform and reading it is not an exposed operation. Sometimes it is nobody, because it is a vector store with several million entries and no schema for provenance. Occasionally someone has looked and describes what they found with the particular unease of a person who expected a filing cabinet and found a diary. What I have never once heard is a description of a process — a review, a cadence, an owner, a retention rule. Memory is the surface where the argument I have made elsewhere about prompt injection quietly stops working, and it is the surface nobody has governed.

The claim of this piece is specific, and I want to state it before the supporting material rather than after. The architecture that survives injection separates the component that reads untrusted content from the component that holds authority. That separation is a boundary in space, drawn across a session. Persistent memory is a boundary in time that nobody drew — the one sanctioned path from the quarantined side of the system into the privileged side, running in the direction that looks safe, delivering into a session that has not happened yet. And what arrives on the far side is not an attack on authority, which the enforcement layer is built to stop. It is an attack on the premise, which it is not.

Memory is four different things, and only the harmless one is governed

Agent memory is a category rather than a component, and the risks do not generalise across it, so the taxonomy is worth setting out before the argument depends on it.

Four memories, one governance regime Each type carries a different risk. Only the least dangerous of the four is governed by anything. THE MEMORY HOW LONG IT LIVES THE RISK IT CARRIES GOVERNED BY working the current turn the session only lowest — it is discarded when the session ends the framework, implicitly episodic what happened, with whom across sessions cross-user leakage; past bias persisting forward nobody semantic what it treats as known indefinitely a poisoned fact survives model updates — it is not in the model partially — where retrieval governance covers the store shared what the ensemble knows indefinitely, and across agents one agent's contamination becomes every agent's starting premise nobody OWASP added memory and context poisoning as ASI06 in 2026. That names the risk. No framework yet specifies the control. THE HONEST LIMIT This four-type taxonomy is borrowed from cognitive science; it is a convenience, not a standard. Real systems blur it — one vector store often serves as all three persistent types at once, which is why the risks entangle. The one type everybody governs is the one that deletes itself. vikramjha.work

Working memory — the current turn's context, the user's input, the retrieved material, the intermediate reasoning — is what everyone means when they say context, and it carries the least risk for the simplest reason: it is discarded. Whatever went wrong inside it ends when the session ends. Every governance framework that touches memory at all is really talking about this one, which is a little like inspecting the vehicle that is about to be scrapped.

The other three persist. Episodic memory is the record of what happened before and with whom, kept so the agent can be useful on the second call — and it carries cross-user leakage and the persistence of past bias into future behaviour. Semantic memory is what the agent treats as known, which may sit in a retrieval store, a fine-tune, or a structured fact base, and its distinctive property is that a poisoned entry survives model updates, because it was never in the model. Shared memory is what an ensemble holds in common, and its property is that one agent's contamination becomes every agent's starting premise, without any of them doing anything wrong.

OWASP added memory and context poisoning to its 2026 agentic top ten as ASI06, which is a real advance and worth acknowledging: naming a risk class is how a field starts taking it seriously. What ASI06 does not do — what nothing yet does — is specify a control. That gap is the reason for the second half of this piece.

The defence was built as a boundary in space, and it works

Take the existing defence at full strength, because the argument here depends on it being good rather than bad. Prompt injection is not solvable at the model layer: a language model's core competence is treating text as potentially meaningful instruction, there is only one channel, and no fine-tune builds a second one. What survives red-teaming is architectural, and it comes down to a single principle — the component that reads untrusted content must not be the component that holds authority — realised as three moves. Separate the planes, so a quarantined model reads the untrusted material and returns typed data rather than control flow to a privileged model that never sees the raw text. Confine by capability, so the quarantined side has nothing to abuse when it is successfully persuaded. And gate at the point of action, deterministically, with an evaluator that never read the untrusted content.

That design is right and I would still recommend it tomorrow. Its cost has been measured and is bounded — CaMeL reports solving 77 percent of AgentDojo tasks with provable security against the injection class against 84 percent undefended — and the mechanism is legible in a way that classifier stacks never are. The point below is not that the architecture fails. It is that the architecture is specified as a property of a session, and every serious agent product shipped in the last two years has added something that outlives the session.

Memory crosses the boundary, in the direction nobody guards

Look at where a memory write comes from. The agent has just processed something — a retrieved document, an email, a tool result, a page — and decides that some part of it is worth keeping: a summary, a stated preference, an entity it should remember, a fact about how this customer's account works. That decision is made on the quarantined side, because the quarantined side is where the untrusted content was read. The artifact it produces is written into a store. Nothing about that write looks like an escalation, because it runs from the low-privilege component to a database rather than to a tool.

The boundary was drawn in space Plane separation holds inside a session. Memory carries the untrusted content across into the next one. SESSION ONE — THE DEFENCE WORKING untrusted content a page, an email, a tool result quarantined model no tools, no authority typed data not control flow privileged model never reads the raw text the write — a summary, a preference, a note to self, a fact worth keeping This is the only path in the architecture that crosses the trust boundary — and it crosses in the safe direction, quarantined to privileged, which is why nobody treated it as a crossing. days · weeks · months SESSION TWO — THE SAME CONTENT, NOW TRUSTED the memory store loaded at start-up the privileged context no quarantine on this path the action taken with full authority Attack and effect are decoupled in time. Write today; act wrongly in November. THE HONEST LIMIT This is a mechanism, not a measured rate. The July 2026 Bad Memory study — Claude Code and OpenAI Codex, four models — found agents largely resist writing untrusted content into their own memory files, while payloads already planted there attacked current and future sessions. The read path is the undefended one. A boundary in space is a design. A boundary in time is one nobody drew. vikramjha.work

Now start the next session. The store is loaded into context at initialisation, on the privileged side, as trusted material — because it is the system's own memory, produced by the system, and no architecture treats its own persistent state as adversarial input. The quarantine is not applied on this path; there is usually no quarantine on this path to apply. The untrusted content of session one has arrived in the privileged context of session two, having been laundered through a store and rewritten in the system's own voice. The trust boundary was never breached in the sense the designers were guarding against. It was routed around, through the one channel that was built to cross it.

The consequence is a change of category rather than of degree, and it is the part of this that I think is genuinely underappreciated. The gate at the point of action evaluates whether the proposed action is within the entitlement. A memory-borne injection does not need an action outside the entitlement. It needs the agent to make a wrong choice among actions that are all comfortably inside it — to route this class of case to the wrong queue, to apply the discount the note says this customer is entitled to, to treat a supplier as pre-approved because it remembers that being established. Every one of those passes the gate, because nothing about them is out of scope. The injection has been converted from an attack on authority, which the enforcement layer is designed to catch, into an attack on the premise, which it is not.

And this is where the evidence problem lands. The November transcript shows an agent reasoning coherently and acting within its permissions on a premise that is simply false; there is nothing anomalous in it to find. The premise entered in April, in a session that is either archived, aged out, or was never a conversation at all. Chat logs are not evidence. The record that would answer where did this belief come from is a provenance field on the memory item, which almost nobody writes — and without it, the honest answer to a reviewer's question about why the agent believed that is that the organisation has no way of knowing.

What the research shows, and where it stops

The 2026 literature supports a narrower claim than the alarm around it suggests, and a sharper one, and both halves matter.

The write path has some defence. The read path has none. The University of Washington study published in July 2026, testing Claude Code and OpenAI Codex across four models, found that agents largely resist being made to overwrite their own memory files with untrusted content — the models decline, which is a real and somewhat encouraging result about instruction-hierarchy training doing its job. What the same study found is that payloads already planted in those files successfully attacked current and future sessions, with success and persistence varying substantially across systems, models, adversarial goals and multi-session sequences. Read those two findings together and the shape is clear: the defended surface is the one the model can refuse, and the undefended surface is the one it has no opportunity to refuse, because by the time the material is loaded it is no longer presented as a request.

The more useful the memory, the more exploitable it is. The systematic study published in June 2026 built a benchmark for the class and mapped four memory write channels and nine structural vulnerabilities across model capability, prompt design and agent architecture. Its central finding is the uncomfortable one: agents designed to write and retrieve memory more aggressively are more exploitable. That is not a bug to be fixed in a framework release — it is the same coupling between capability and susceptibility that runs through this whole field, and it means the mitigation cannot be make the memory less useful, because usefulness is the entire reason the memory exists.

Existing injection defences do not cover it. The same work reports that prompt-injection defences fail to cover memory poisoning, which follows directly from the mechanism above: a defence that inspects untrusted input at the moment of ingestion has nothing to inspect when the material arrives as the system's own state. Vendor security research has independently demonstrated indirect injection persisting into long-term memory and being carried into subsequent orchestration. The class is real, it is reproducible, and it is out of scope for the controls most teams believe cover it.

Where the research stops is on prevalence. There is no published measurement of how often this happens in production estates, no incident with the evidentiary weight that EchoLeak carried for the in-session case, and nothing that lets anyone put a rate on it. Everything above is mechanism and benchmark. I think the mechanism is sufficient to act on — it is legible, it is demonstrated, and the cost of the mitigation is low — but anyone who tells you they know the base rate is guessing.

The other failure is the one the retrieval layer already taught us

Cross-user leakage through memory is not a new failure mode; it is the access-control failure from the knowledge layer, repeated one layer down by teams who fixed it upstream and did not notice it had reappeared. The pattern is identical. A store is populated from many principals' interactions. Retrieval is by similarity rather than by entitlement. The agent asks for what is relevant, gets what is relevant, and surfaces something that belongs to somebody else.

What makes the memory version worse than the retrieval version is that it is silent in a way retrieval is not. When a retrieval system returns a document the user should not see, there is a document — an artifact with an owner and a classification, and an audit trail that will eventually show it moving. When a memory system carries one user's context into another's session, what surfaces is usually not a document but an inflection: the agent knows something it should not, and expresses it as familiarity. It says of course, you had trouble with this last time. Nobody files an incident about an agent being helpful. The failure can run for a year.

The fix is the one the context layer arrived at, applied to the store the agent carries rather than the corpus it queries: partition by principal and by purpose, and enforce at retrieval time rather than only at write time. Write-time partitioning is what most implementations have, and it is insufficient for a boring reason — memory is frequently reorganised, summarised, consolidated and re-embedded by background processes, and every one of those operations is an opportunity for material to lose the label that was supposed to confine it. The check has to be at the moment of use, on the same principle that makes runtime enforcement stronger than login-time enforcement: the doorway is not the checkpoint.

The drift nobody attributes to anything

There is a third failure that is neither adversarial nor an access-control breach, and it is the one that will generate the most confusion in the next two years. An agent's behaviour changes over months, without a code change, without a model update, and without anyone shipping anything — because its memory has accumulated. It has seen a thousand cases, it has kept summaries of some of them, and the distribution of what it kept is not the distribution of what happened.

This is genuinely hard to detect because every monitoring instinct people bring to it is calibrated for discontinuity. Model drift monitoring looks for a step change at a version boundary. Incident detection looks for anomalies. Memory drift is a slow rotation with no boundary to anchor to, and the first observable symptom is usually a decision that a human reviewer finds odd, months after the rotation began. The mitigation is not exotic — a fixed evaluation set run against the live agent on a cadence, with the memory in place rather than cleared for the test, and a comparison against the same set run at deployment — but note what it requires. It requires that clearing the memory for a test is possible, that the memory's contents at a past point can be described, and that somebody owns the cadence. Those are the same three requirements as everything else in this piece, which is not a coincidence.

Scope, retain, audit, expire

The primitive I use is the authority primitive pointed at a different object. Authority becomes governable when a grant is scoped, time-boxed, recorded and expiring. Memory becomes governable under the same four properties, and the parallel is not decorative — a memory item is, functionally, a standing instruction the agent gave itself, and standing instructions are exactly the thing we already know how to govern.

Scope, retain, audit, expire The same four properties that make authority governable, applied to the store the agent carries forward. SCOPE — whose is it, and for what? Implemented partitioned per principal and per purpose, enforced at retrieval time — not only at write time Without it one user's context surfaces to another, silently — the agent never announces what it retrieved RETAIN — how long may it be kept? Implemented a retention class on every item, derived from purpose and jurisdiction rather than from convenience Without it unbounded accumulation, and every storage-limitation obligation becomes unanswerable AUDIT — what is in there, and who put it there? Implemented every item carries provenance: its source, its session, and whether it derives from content you did not control Without it remediation is impossible — a poisoned item cannot be found, so the only clean-up is deleting everything EXPIRE — when does it go? Implemented automatic eviction on retention expiry, on consent withdrawal, and on incident Without it a poisoned item is permanent, and it outlives every model update you will ever ship Audit is load-bearing. You cannot remediate a memory you cannot attribute. THE HONEST LIMIT No standard specifies this. OWASP names the risk; the agentic profiles and identity frameworks cover identity, policy and attestation, not memory. Read this as the shape the standard will take, not as the standard. Grant, scope, expire, record — the authority primitive, pointed at the thing the agent keeps. vikramjha.work

Of the four, provenance under audit is the load-bearing one, and it is the one implementations skip because it costs storage on every write and pays nothing until the day it pays everything. Every memory item should carry where it came from: which session, which principal, which source material, and — the field that matters most and exists almost nowhere — whether it derives from content the organisation did not control. That last flag is what makes selective remediation possible. Without it, discovering that a poisoned entry exists somewhere in a store of several million items leaves exactly one remedy, which is to delete the store and lose everything the agent has learned, including the value that justified building the memory in the first place. Teams facing that choice consistently choose not to look.

Three markets, three reasons this becomes concrete

United States: the exposure is discovery and reconstruction. The supervisory position after 17 April 2026 — Fed SR 26-2 and OCC Bulletin 2026-13, superseding SR 11-7 and placing generative and agentic AI expressly outside scope with separate guidance promised — removes the framework that would have specified what to retain and for how long, without touching a single underlying obligation. What fills that space first, in practice, is litigation rather than examination: an ungoverned memory store is discoverable, it is unstructured, it contains customer-derived material nobody classified, and it cannot be described to a court by anyone in the organisation. The retention question is the sharp end. A store with no retention class is a store you must keep and must produce, and the party that decides what is relevant in it will not be you.

India: memory is a processing activity, and the statute is explicit about it. Under the DPDP Act, personal data may be processed for a stated purpose, must not be retained beyond the point at which that purpose is served, and must be erasable on withdrawal of consent. An agent memory built the ordinary way violates all three by construction: it retains because retention is the feature, it uses yesterday's material for tomorrow's unrelated purpose because that is what makes it useful, and it cannot erase one principal's contributions because nothing recorded whose they were. Of the three markets this is where the primitive stops being good practice and starts being the mechanism by which a statutory obligation is met, and the scope and expire components are the ones that earn their cost first.

The Gulf: new-build, and therefore cheap — if the schema decision is made now. Most Gulf agent estates are being constructed rather than retrofitted, and the supervisory expectations — the Central Bank of the UAE's February 2026 guidance note, and comparable SAMA frameworks — are framed around documented governance and board accountability for outcomes rather than around a control list, which leaves the architecture free. Adding a provenance field and a retention class to a memory schema before the first write costs an afternoon. Adding them to a store with two years of unlabelled entries is not a schema change; it is an archaeology project with no reliable answer at the end, because the information was never captured. This is one of the few places in agent governance where the whole difference between trivial and impossible is a decision taken in week three.

What this argument does not prove

Four limits, and the first is the one a good critic would open with.

The temporal-boundary argument is a mechanism, not a measured phenomenon in production. I can show that the path exists, that the research demonstrates payloads persisting and acting across sessions, and that the standard defences do not cover the path. I cannot tell you how often it happens in a real enterprise estate, and neither can anyone else, because nobody is instrumented to detect it — which is itself an argument for the provenance field, but is not evidence of frequency. A reasonable sceptic can say this is a demonstrated capability in search of an incident, and today that is fair.

Second, the four-type taxonomy is a convenience borrowed from cognitive science, not a standard, and real systems blur it badly: one vector store often serves as episodic, semantic and shared memory simultaneously, which is why the risk profiles entangle in practice in ways the neat table does not show. Third, the primitive is a practice position. OWASP names the risk; the agentic profiles and identity frameworks cover identity, policy and attestation and are silent on memory. I expect a standard to arrive and I expect parts of my version of it to be wrong — the retention semantics in particular, where the interaction between a purpose-bound retention class and a legal hold is something I have not seen anyone solve cleanly.

Fourth, and most importantly: governing memory does not make an agent's judgement good. Scope, retain, audit and expire bound what the agent may carry, from where, and for how long. They do not tell you whether what it carries is true. An agent operating on a perfectly provenanced, correctly scoped, appropriately retained memory of a genuine but unrepresentative set of past cases will make bad decisions with an impeccable audit trail. This layer buys you the ability to find out why — which is a great deal, and is not the same thing as being right.

The test I would put to your own estate is a single exercise, and it takes an afternoon. Pick one agent with persistent memory. Ask three questions: what is in the store, where did each item come from, and what would we delete if we learned that one item was planted. If the first question has no interface, the second has no field, and the third has no answer short of deleting everything, then memory is not a risk surface you have accepted — it is one you have not yet noticed. If you are deciding what your agents may keep before someone else asks you what they know, that is the kind of working session I do.