Five agent-memory papers, October 3–9: a plan written as fact, a superseded value, another user's memory in the index — and the check each pipeline skips
Five primary-source papers from October 3–9, 2026 locate agent memory's failures at boundaries the pipeline crosses without checking: who owns a record, a plan stored as a fact, a superseded value, the agent's own evidence verdict, and a memory tier whose measured gain was an artifact.
From October 3 through 9, 2026, five primary-source papers in AI agent memory landed on one shape of failure. Each system already held the information that would have settled whether a stored record was safe to use: who owns it, whether the speaker meant a plan or a fact, which revision is current, whether the agent's own verdict says the source has gone dead. In each case the pipeline did not read it. The number at the end of the pipeline stayed quiet too, which is why every fix proposed this week sits at a boundary between stages rather than inside the model.
A plan is written down as a fact
Date: October 6, 2026
What happened: A user mentions they have been thinking about maybe moving to Seattle. Three weeks later they ask for a booking near where they live, and the assistant acts on a move that never happened. Chirag Sharma and colleagues at Distyl AI name this speculation contamination: a speculative statement stored as the current value of a profile field. 1
On 147 held-out conversations whose plans are later confirmed, abandoned or left unresolved, Mem0 answered 78.9% of final questions correctly while asserting never-true plans as current state for 35.2% of pending plans. Zep Graphiti answered 48.3% correctly and contaminated 27.3%. Final-answer accuracy and correctness inside the pending window turn out to be separate capabilities.
AgentMemGate is a write-time gate that sorts each extracted statement into speculation, completed event, correction or other, and holds speculations outside memory under conditions for later promotion or deletion. On the authors' core benchmark it removes all observed contamination against the identical ungated pipeline, 87.5% to zero on the most exposed extraction style, and lifts task accuracy from 65% to 95%. 1
The ceiling is stated just as plainly. Field matching is the remaining bottleneck: a realistic speculation often matches no profile field and never reaches the gate, and at conversation end 85–90% of plan entries are still unresolved.
Why it matters for builders: If your assistant's memory is a profile store with one current value per field, this error class is invisible to your evaluation, because the benchmark scores after outcomes arrive and confirmations repair the store before the final question. Keep plan-framed statements out of the current-value slot, then re-test them when the conversation resolves. Watch the gate's own blind spot as well: a speculation that matches no field is never even a candidate, so count how many statements reach the classifier.
The memory serves a value that was already replaced
Date: October 7, 2026
What happened: Haonan Deng and Park Sinchaisri measure the memory block itself, before any text is generated, and give the three ways it can fail: a superseded value, a fact about the wrong person, and a block that arrives after prefill has begun. 2
Serving only the active value of each correctly keyed slot removes stale exposure entirely on their controlled revision benchmark. Without update resolution, 70.3% of prompts expose a superseded value, usually sitting beside the current one.
Assigning a revision to the right slot is the harder half. Four LLM key assigners reach key recall above 0.980 on paraphrased text yet produce lower clean-retrieval rates than a rule extractor with lower recall, because they occasionally merge two slots. On LongMemEval, where the slot vocabulary is not supplied, merge recall never exceeds 0.062 even when the assigner can see the store's existing keys, and exposing those keys pushes cross-question merging from 0.042 to 0.294. Misattribution survives validity filtering: an entity posterior reduces same-name exposure on controlled data and cannot separate identically named speakers in LoCoMo. Retrieval latency varies across rankers, but prompt prefill dominates turn-level latency on their hardware, so the authors treat lateness as a serving property that no better ranker fixes. 2
Why it matters for builders: A final-answer score cannot separate a clean prompt from one carrying both the current and the superseded value, since a lucky choice looks identical to a correct store. Read the memory block before generation and score the four things separately: stored-state validity, identity resolution, abstention, and serving latency. Treat key assignment as the risky step rather than the retrieval ranker, and prefer the assigner with the better precision over the one with the higher recall.
The nearest memory in the index belongs to someone else
Date: October 3, 2026
What happened: Enterprise agents keep a shared vector store for long-term memory. MemLeak shows that ordinary cosine similarity, with no exploit and no adversarial prompt, retrieves one user's memories into another user's session because the two are close in embedding space. The authors call it cross-user admissibility failure. 3
Under pooled same-team retrieval, incidental leakage reaches 70–100%. Adversarially crafted memories take 90–100% of top-k slots, and end-to-end response contamination reaches 5.00/5 on a production retrieval path and 4.67/5 with Claude Sonnet 4.5. Contaminated answers often score as helpful, or more helpful, than clean ones — a gap the authors checked against human judgment. 3
Three mitigations were tested. Metadata filtering stops working once retrieval scope widens to include an attacker, prefix injection reduces leakage only partially, and hard post-retrieval ownership gating — dropping every hit whose owner is not the querying user — restores the clean 1.00/5 baseline on both generation models at roughly 1.4 ms of added latency per query. Each rate comes from 10 queries per condition, and the study is built to establish the mechanism rather than estimate real enterprise leakage rates.
Why it matters for builders: Ownership held as soft metadata is not a boundary. If you run one index for many users, put a deterministic gate after retrieval that discards hits from other owners, and measure its latency rather than assuming it. The cheap test is to seed one user's memory with something distinctive, query the same index as a second user with a similar profile, and read the answers. A retrieval score will not show you this, because retrieval is working exactly as designed.
The agent says the source is useless and queries it again
Date: October 5, 2026
What happened: Chubin Zhang and colleagues put seven tool-using agents in front of a search source that fails partway through, with a side channel recording what each agent privately thought of each result. Every agent whose judgments they recorded calls a failing source's results useless 97–100% of the time. Yet after five such verdicts in a row, five of the seven answer on at most 7% of questions and search until the budget runs out. 4
Answering at that point was usually a better bet than continuing. Forced to answer there, Claude Haiku 4.5 is right on 114 of the 284 questions where it happens.
Prompt wording changes when an agent stops without changing what it stops on: permission to answer from memory and a reasoning mode produce early stops regardless of the evidence, and a stated budget moves the 7–8B models' stops to the deadline. Stopping follows the evidence only when the harness enforces an integration step, making the agent answer after five consecutive results it judged useless. That step raises failing-source success for every model, holds the stopping point fixed when the budget doubles, and needs no extra judgment call where the agent already states its verdicts. A pre-registered replication on 300 fresh questions reproduced it. 4
Why it matters for builders: The judgment layer here is accurate; the control layer is what ignores it. Telling an agent in the prompt to stop on useless results buys you a change in timing and nothing else, so put the rule in the harness, where it can act on verdicts the agent has already produced. Log those verdicts too. They are free to collect and they turn "the retriever is drifting" into a counter you can alert on before the budget runs out.
The ablation asked memory to recall something it could not use
Date: October 6, 2026
What happened: Many long-context systems split work across cooperating agents and then add a persistent tier that stores and recalls reasoning traces, backing the tier with an ablation that reports an accuracy gain. Hochan Son and colleagues measured both parts of one such three-tier architecture. The decomposition holds: peak KV working set of 14.3 MiB per query against 35.5 and 35.3 MiB for single-pass and retrieval-augmented baselines. 5
The persistent tier costs +0.368 MiB of peak cache, interval [+0.167, +0.590], and buys no detectable accuracy change: +0.015, 95% CI [−0.011, +0.046], across eight dataset pairs at n=100 per arm.
The authors argue the null is structural rather than a verdict on their tier. Single-question benchmarks hand each item its own evidence and score it alone, while correctness forces stored traces to be reset between conditions, so recall can only reach traces left by unrelated items. Reproducing the retriever's own predicate, recall was reachable for 24% of questions as sent. Reaching that measurement took four corrections: a persistent tier that executed and wrote nothing any reader read, trace contamination that left 100 of 100 of a run's questions already carrying a stored trace, an order and parser confound that read +0.370 on an MMLU-Pro pair as a memory win, and an effect that never cleared the measurement floor of its own replicate band. None of the four was visible in the results table. 5
Why it matters for builders: On an independent-item benchmark, a non-zero memory effect is more likely an artifact than a finding. Before you quote one, assert that each component executed by emitting a counter the run summary refuses to omit, query the store with the evaluation questions before the run so contamination shows up as a hit, diff the two arms' serialized requests and counterbalance their order, and require the effect to clear a band estimated from replicates. Then test the memory where items genuinely share state, such as multi-session dialogue, a corpus queried repeatedly, or an agent returning to the same entities.
Issue summary
Three patterns run across the five items.
- The check is cheap, and the information for it is already in the record. Ownership is a column, the plan-or-fact distinction is in the utterance that produced the memory, the revision is a key, and the agent's verdict on a result is already written into its own reasoning. MemLeak measures its ownership gate at about 1.4 ms per query, and participant-aware BM25 matches a full reference ranker within a ±0.02 margin. The cost of any of these checks is the decision to make it.
- The error is invisible at the end of the pipeline. Mem0's 78.9% final accuracy sits beside 35.2% pending contamination; a final-answer score cannot tell a clean prompt from one carrying a stale value next to the current one; an agent right on 114 of 284 questions still burns its budget searching; a memory tier shows +0.015 with an interval that spans zero. Instrument the stage where the decision is made, because the answer at the end absorbs all of them.
- What each fix still misses is the record that arrived without a key. A speculation matching no profile field never reaches the gate. Identically named speakers defeat the entity prior. Merge recall collapses when the slot vocabulary is not handed to the assigner. Traces written by unrelated items cannot help a question and hide the effect being tested. The boundary is the place to label, because that is the only moment the evidence is present.
One concrete next action
Audit the boundaries of the memory you already run.
- Plant three probes. Write a plan that never comes true, then ask the pending-window question that depends on it. Revise a stored fact, then ask the question again. Repeat the same query as a second user with a similar profile in the same index. Read what each answer used.
- Log the agent's own verdicts. Have it state, on each retrieval, whether the returned result was useful, then check whether that verdict changed its next call. Where it did not, move the rule into the harness rather than the prompt.
- Re-read your last memory ablation against the four conditions. A counter per component that the summary refuses to omit, a store pre-query with the evaluation questions, a serialized-request diff between the two arms, and an effect that clears a replicate-based band. Then rerun the whole thing where items share state.
References
- 1
- 2
- 3
- 4
- 5
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.