Four new tests for agent memory: state drift, write decisions, harmful reuse, and reliability, August 20–21, 2026

The August 20–21, 2026 window produced four strong tests of agent memory. Each paper moves the question one step beyond retrieval: can an agent keep the current state, decide what deserves durable storage, resist harmful memories, and repeat a correct state-changing action? All four papers are version-one arXiv submissions dated August 20, 2026. 1 2 3 4

StateMem separates recall from current state

Date: August 20, 2026

What happened: Can Agent Memory Systems Track Evolving State? defines a failure that ordinary retrieval scores can hide: state drift. An agent may retrieve the right conversation or document and still act on a value that a later interaction superseded. The paper introduces StateMemBench, which contains 234 multi-session scenarios across three domains. Its closed-pool grader distinguishes an answer based on the current state from one based on a superseded state. 1

StateMem represents explicit supersession and relational dependencies. When one fact changes, the memory method can update a dependent or derived value instead of treating every stored statement as an independent search result. On DeepSeek-V4-Flash, StateMem raises current-state accuracy from 0.205 to 0.363, a 1.8× improvement over the strongest same-backbone baseline. On Qwen-3.5-9B, it raises accuracy from 0.149 to 0.233, a 1.6× improvement over the strongest memory system. 1

The paper also tests a lightweight answer-time wrapper over six memory and retrieval backends. The wrapper adds 32 to 67 percentage points of current-state accuracy. A control matched for context length and cost attributes 15 to 32 of those points to the state structure rather than to extra context. 1

Why it matters for builders: A memory record needs more than text, an embedding, and a timestamp when later decisions depend on revisions. The minimum useful structure includes the current value, superseded values, the event that changed the value, and links to derived values that need recomputation. The prerequisite is a source of truth for those relations. The first evaluation to add is a paired query: ask for the current value after several revisions, then ask for a derived value that depends on the revision. A retrieval hit should count as success only when the answer uses the operative state.

MCB makes the write boundary measurable

Date: August 20, 2026

What happened: Remember, Verify, or Ask? studies the memory–clarification boundary: whether an agent should persist information, use it only in the current interaction, verify it against the world, or ask the user to resolve an ambiguity. MCB contains 140 primary scenarios, divided into 70 development items and 70 held-out items, plus a separate 70-item contrast set. It scores both a stated label and the structured tool call that would perform the action. 2

The benchmark exposes a specific imbalance. Bare Qwen verifies 12 of 18 freshness items and asks on 0 of 12 clarification items. Few-shot prompting raises overall accuracy from 0.557 to 0.771, while clarification recall remains 0.333. A policy prompt reduces erroneous persistence from 0.243 to 0.100, although its overall accuracy gain is not significant. 2

The stated answer can also diverge from the action. Label–tool agreement is 57% for each tested Claude model and 23% for Qwen; Qwen accuracy falls from 0.557 on labels to 0.343 when the benchmark evaluates the corresponding tool choices. The held-out and contrast labels reached 97.1% agreement between two non-authors, with Cohen's κ of 0.962, so the ambiguity comes from agent behavior rather than an obviously unstable labeling process. 2

Why it matters for builders: A memory pipeline has at least four materially different actions: durable write, local-only use, world verification, and user clarification. A single memory-accuracy score collapses those actions into one number. The practical cost of MCB-style testing is a labeled policy set plus an executable tool environment. The benefit is a direct measure of over-memory, under-asking, and verification behavior. Run the same cases twice: once against the agent's stated decision, and once against the tool call that changes durable state.

MemTrapBench tests when memory makes the answer worse

Date: August 20, 2026

What happened: MemTrapBench evaluates a failure that remains invisible when a benchmark asks only whether a memory was relevant and correctly retrieved. A memory can be accurate, relevant, and harmful to the current task. The benchmark contains 1,050 instances across four scenarios and separates two failure modes: Reasoning Fixation, where an old strategy narrows the model's search, and Belief Distortion, where an old belief shifts the model's judgment. The authors test five memory strategies on Gemini-3-Flash-Preview and Qwen3-30B-A3B-Instruct-2507, alongside a no-memory baseline. 3

The no-memory control changes the takeaway. On Gemini-3-Flash-Preview, the no-memory baseline reaches 85.16% while the strongest tested memory strategy, EverMemOS, reaches 71.17%. On Qwen3-30B-A3B-Instruct-2507, the corresponding figures are 81.83% and 70.13%. The paper reports drops of more than 10 percentage points even for the strongest memory methods. 3

The proposed AdaptiveMem adds an inference-time instruction that tells the model to avoid memory traps. On Gemini, AdaptiveMem improves LightMem by 14.9 points on MemTrapBench while preserving standard memory-benchmark performance. 3

Why it matters for builders: Every memory change needs a current-task control. Compare the same model and task with memory enabled and with memory withheld, then inspect the difference in reasoning rather than only the retrieved text. The prerequisite is a paired test set containing strategy fixation, scope transfer, and belief distortion cases. The trade-off is extra evaluation work: a memory system that improves long-term recall can still reduce performance on the task in front of the agent.

Thinkingbox turns persistence into repeatable state changes

Date: August 20, 2026

What happened: Thinkingbox introduces a sandbox for stateful business workflows rather than a retrieval-only memory benchmark. Thinkingbox-bench contains 507 policy-conditioned workflows across retail, hospitality, auto insurance, neobank IT, and consulting IT/HR support. Agents use MCP-compatible tools against an isolated backend; later calls see earlier state changes, and executable checks inspect the terminal state, event log, and forbidden collateral effects. Each task runs for 20 independent attempts from the same initial state. 4

Across 12 proprietary and open-weight models, GPT-5.4 reaches the highest pass@1 score at 65.36%. Here, pass@1 means that one attempt succeeds. Across 20 attempts, GPT-5.4 succeeds at least once on 91.12% of tasks, but succeeds on all 20 attempts on only 25.25% of tasks. The gap separates the chance of finding one valid trajectory from repeatable reliability. 4

The benchmark's failed trials most often contain tool-usage or recovery errors, which account for 77.5% of the reported failure signatures. Wrong state updates account for 12.1%. The evaluation therefore catches failures that a final-answer grader can miss: duplicate records, changes to the wrong entity, unauthorized side effects, and a workflow that stops before the required state transition. 4

Why it matters for builders: Long-running agents need a stateful environment with an executable oracle, not only a question-answer set. The cost is substantial: deterministic fixtures, side-effect checks, isolated resets, and repeated attempts. The payoff is a metric that separates best-case capability from operational reliability. Start with the terminal state and forbidden effects; add final-response checks after the state transition works consistently.

Issue summary

Three patterns connect the four papers, based on the mechanisms and controls they test:

State has a history. StateMemBench makes supersession explicit, while Thinkingbox evaluates a sequence of actions against an evolving backend. A memory record and a tool state both need a current version and a way to identify effects that followed from earlier versions. 1 4
Remembering is an action policy. MCB separates persistence, local use, verification, and clarification. MemTrapBench adds a second policy question: whether retrieved information should influence the current reasoning path at all. 2 3
A best run is a weak reliability claim. The strongest result in a single trial can coexist with poor repeatability, and a memory method can improve retrieval while harming current-task accuracy. The evaluation unit has to include controls and repeated runs. 3 4

One concrete next action

Before adding another retrieval layer, build a small four-panel regression suite around the agent you already run:

Revise a fact two or three times, then test current-state and derived-value answers.
Present fresh, ambiguous, and user-specific facts, then inspect whether the agent persists, uses locally, verifies, or asks.
Pair each memory-enabled task with a no-memory control containing a relevant but potentially misleading prior example.
Reset one deterministic backend and run 20 attempts, recording terminal state, recovery errors, and collateral effects.

Report four numbers: current-state accuracy, erroneous-persistence rate and clarification recall, the performance delta against the no-memory control, and the gap between at-least-once success and all-attempt success. Those measurements tell you whether the next bottleneck is state representation, commitment policy, safe reuse, or execution reliability before you choose a new memory architecture.

Four new tests for agent memory: state drift, write decisions, harmful reuse, and reliability, August 20–21, 2026

StateMem separates recall from current state

MCB makes the write boundary measurable

MemTrapBench tests when memory makes the answer worse

Thinkingbox turns persistence into repeatable state changes

Issue summary

One concrete next action

References

Related content