Five agent-memory papers, September 12–18: poisoned writes, stale majorities, replay audits, and evidence sets (2026)

From September 12 through September 18, 2026, five primary-source papers in AI agent memory each took charge of a different stage of maintaining one object: the accumulated store. Together they move the engineering question from how to retrieve better to how to keep a state correct while it changes — what gets written in, which record wins when two contradict, what a retrieval should change in the store, what an evaluation can observe, and how much of it one decision needs.

A poisoned write outlives the reminder meant to stop it

Date: September 12, 2026

What happened: Two researchers described PMPA, a persistent memory poisoning attack on harness-based agents — the kind of agent, such as Claude Code or OpenClaw, that wires memory, tools, and runtime control into one loop. PMPA hides a malicious rule inside an ordinary external source, a document, image, or PDF the user hands the agent for an unrelated question, and phrases the payload in the first person so the agent files it as the user's own standing preference. A later session retrieves the rule beside a benign workspace task, and the rule fires. 1

The evaluation ran both harnesses against DeepSeek-V4-Flash, DeepSeek-V4-Pro, and Qwen3-Max in a virtual workspace holding email, calendar, shared-document, and form data; 30 question-answering items were paired with four scenario payloads and rendered as text, image, and PDF for 360 injection samples. Across all settings PMPA reached an average Injection Success Rate (ISR, the share of sources where the payload reached memory) of 73.7% on OpenClaw and 66.9% on Claude Code, with a Cross-session Attack Success Rate (C-ASR, the share of later sessions where the stored rule produced the malicious action) of 55.5% and 81.7% — the best single configuration, Claude Code on DeepSeek-V4-Flash, reaching 92.5%. Benign task performance held. 1

A prompt-level defense — safety reminders before and after the user's message, telling the agent to treat external content as task data and to confirm before saving rules — cut image and PDF injections sharply: Claude Code's calendar ISR fell from 83.3% to 6.7% on PDFs. Text injections held, falling only from 96.7% to 84.4%, and cross-session attack success barely moved, from 96.7% to 96.7% for Claude Code images and 97.8% to 96.7% for OpenClaw. 1

Why it matters for builders: A reminder protects the writing of memory, and once a poisoned rule sits in the store, nothing at trigger time removes it. The write gate is where a harness can still act: log every write originating in external content, require explicit confirmation before external text becomes a standing rule, and give users a way to list and delete stored rules.

When old records outnumber the new one, the majority decides

Date: September 13, 2026

What happened: The Immutable Past formalizes Semantic Shadowing, the failure mode of an append-only store that keeps every earlier version of a fact. Old and new values are semantically equivalent to a retriever and logically contradictory to a reader, so their embeddings sit close together and nothing in dense retrieval prefers the newer one. Two results follow: the expected number of valid chunks inside a top-k retrieval set drops as history accumulates toward zero, and even when a valid chunk is retrieved, attention spreads roughly evenly, so the answer reverts to the stale value with probability near (k−1)/k. Widening the context window makes both worse. 2

GC-Mem filters at inference time. Each retrieved chunk carries content, a strict timestamp, and a relevance score; a pairwise natural-language-inference check (a model call deciding whether two statements contradict) tests every pair inside the retrieved set; and a temporal dominance operator keeps a chunk only if no newer retrieved chunk contradicts it. The store itself stays untouched, and the check costs O(k²) comparisons, about 250 ms on top of a 400 ms retrieval-and-generation pass for k between 5 and 50. 2

On a behavioral benchmark of 137,760 memory chunks, with accumulation ratios swept from 1:1 to 100:1 across four models, GC-Mem recovered 97.3% conflict resolution accuracy with deepseek-v3 against 56.8% for standard retrieval and 20.3% for timestamp re-ranking, and 92.1% with o4-mini against 28.9% and 10.5%. The prerequisite decides whether any of it transfers: the filter is only as good as the contradiction detector's recall. A detector with 99.7% precision and 36.6% recall bought 4.0 points; one with 100% precision and 0.7% recall bought −0.2 and left the pipeline inert. The paper puts the usable threshold at better than 50% detector recall. 2

Why it matters for builders: An append-only store hands the newest fact about an entity a losing vote against that entity's own history, and a better retriever changes nothing. The read-time fixes are a validity interval on each record, so superseded values leave the candidate pool, or a contradiction check inside the retrieved set that keeps only the newest member of each contradicting pair. Measure the detector first, because recall rather than precision decides whether the mechanism works.

Retrieval should leave the store changed

Date: September 13, 2026

What happened: REALM reorganizes memory after reading it. Units are nodes typed as entity, event, episode, or fact, joined by logical, causal, hierarchical, and associative edges that carry confidence weights. Retrieval assembles a query-specific plan from seed localization, adaptive expansion, and filtering; when the task finishes, the system reconsolidates only the activated subgraph, strengthening paths that helped and weakening paths that led nowhere. Other systems write memory when new information arrives and stop at retrieval; REALM makes the retrieval result and the task outcome the signal that reshapes the store. 3

On LoCoMo and LongMemEval_S, two public long-conversation memory benchmarks scored by an LLM judge (gpt-4o-mini deciding whether an answer matches the reference), REALM averaged 75.97% on LoCoMo against 68.80% for the strongest baseline, MAGMA, and 65.11% on LongMemEval against 63.80% for Zep. The LoCoMo lead is broad, at 64.54% on multi-hop questions against MAGMA's 52.80%. The LongMemEval lead is 1.31 points, with REALM trailing MAGMA on single-session preference, 36.66% against 73.30%; its two best categories there are temporal reasoning (56.69%) and knowledge update (88.89%), the two its loop targets. 3

Removing reconsolidation costs 2.01 points on LoCoMo and 2.13 on LongMemEval. The mechanism is worth reading closely: with reconsolidation on, the share of questions where supporting evidence was retrieved rose by 3.70 and 5.41 points, while the share answered correctly after evidence retrieval rose by 20.83 and 19.23. Reconsolidation improved the usefulness of retrieved evidence rather than the reach of retrieval. 3

Why it matters for builders: An agent that never writes back what it learned about its own memory keeps the index you built on day one. A post-task pass that edits only the subgraph a query traversed is cheap and keeps one bad answer from rewriting the whole store. Expect the return in temporal and knowledge-update questions first, and small on aggregate scores.

A memory that ages needs an evaluation that replays it

Date: September 15, 2026

What happened: LSREP, a Longitudinal State-Replay Evaluation Protocol, starts from the fact that conversational memory changes during use, so one end-state question-and-answer score establishes nothing about how a persistent state accumulates, ages, or absorbs revisions. The protocol freezes code, model, configuration, and clocks and ingests only the turns available at each checkpoint; runs simulated decay, reflection, clustering, and consolidation between checkpoints over horizons of 20 to 93 days; re-asks every question that existed at or before a checkpoint, giving 219 probes and 1,211 observations across 52 checkpoints and 1,985 turns; and draws each probe's gold answer only from history available by then. 4

The case study publishes its own system's losses. ICE v2, a local-first memory middleware with typed stores, retrieval fusion, and a dynamic context budget, ran against plain vector retrieval on all 500 oracle and 500 full-session questions of LongMemEval. ICE v2 scored 50.8% against 72.8% in the oracle setting and 43.0% against 69.5% on full sessions, paired differences of −22.0 and −26.5 points, with the damage concentrated in multi-session questions (21.5% against 74.4%). ICE v2 answered with less context than vector retrieval, which the paper reports as a quality-cost trade-off. 4

The transferable part is the mechanism-fidelity check, which traces whether each component received eligible input, executed, produced output, had that output selected, and reached the prompt. On ICE v2 it found procedural retrieval defective through a pgvector operator error that returned an empty list, a document leg with no documents behind it, and empty batch summaries — on a system that had looked close to parity with vector retrieval on its own private corpus. 4

Why it matters for builders: An aggregate score credits a system for behaviour that one working mechanism produced. To learn which component does anything, log per component whether it received eligible input, ran, emitted output, had that output selected, and reached the prompt. Test in both settings as well: a private corpus and a matched public benchmark disagreed by 22 points for ICE v2.

Sufficiency belongs to the set

Date: September 17, 2026

What happened: A coding agent partway through an issue has already read much of what a retriever ranks highest. Ranking scores passages one at a time, while the decision ahead depends on a set; a ranker can spend its whole budget on three variants of one required fact and leave the decision unsupported. SERBench measures this on 500 held-out agent states from 242 real issue instances across 45 repositories, each state carrying a grouped sufficiency certificate that lists the facts its next decision requires. The states split across decision boundaries — before search (200), after search (124), after file inspection (104), before the intended edit (72) — and 284 of the 500 need two or more groups, with a mean of 1.936. Two experts audited 80 states and accepted 77. 5

MSS-Complement treats acquisition as set construction: three semantic calls — propose, expand for what the proposal missed, finalize against joint support — return 4 to 8 ranked units inside a 6,144-source-token ceiling. Against Qwen3-Embedding-8B with a reranker, the strongest retrieval baseline here, MSS-Complement recovered a complete sufficiency set for 73.0% of states at five items and 80.6% at eight, against 61.4% and 72.4%, gains of 11.60 and 8.20 points. A control that ranks by similarity alone reaches 66.6%, which places 6.40 points of the gain in the set-level objective rather than the extra computation, and the gain concentrates where the problem is hardest: 14.79 points on the 284 multi-group states against 7.41 on single-group states. 5

On AMA-Bench, 208 real agent episodes and 2,496 questions, MSS-Complement reached 56.05% accuracy against 53.97% for that benchmark's own memory agent while shrinking the answer prompt by 76.2%, from 13.06K to 3.10K tokens. The cost sits in the controller, at 33.57K online tokens against 13.95K, since three semantic calls run for every state. 5

Why it matters for builders: Whether a retrieved set supports a decision is a property of the set as a whole, and mean rank is the wrong measure. Annotate a few dozen real decisions with the groups of facts each one needs, then score coverage alongside similarity. Adaptive sizing is the cheap half of the fix: returning four to eight units instead of a fixed top-k was worth 3.00 points on its own and lowered the mean context size.

Issue summary

Three patterns run across the five items.

The write path carries the leverage. PMPA's damage is created when external content becomes a stored rule, and its own defense numbers show the trigger stage resisting repair. 1 GC-Mem's arithmetic is fixed by what retention chose to keep. 2 MSS-Complement's 11.60-point gain comes from choosing what enters the prompt rather than from a better ranker. 5
Two of these mechanisms need a second component before they do anything. GC-Mem's dominance filter needs a contradiction detector with better than 50% recall, and a high-precision, low-recall detector leaves it inert. 2 REALM's reconsolidation needs retrieval to have produced a usable subgraph first, and its gains land in the two categories that loop targets. 3
Evaluation is moving from the answer to the state behind it. LSREP replays one memory system across 52 checkpoints and audits each component's role; SERBench scores whether a retrieved set covers the groups of facts a decision requires. Both need annotation work — evolving reference answers in one case, grouped sufficiency certificates in the other — that a single accuracy number leaves invisible.

One concrete next action

Pick one entity your agent discusses repeatedly, and build a three-part trail on it this week.

Write-side census. Log every save into persistent memory that originates outside the user's own message, with its source and session. Count the share the user would recognize as a standing rule they asked for. That count is your write gate's exposure.
Recency check. Pull the retrieved set for 50 questions about that entity, with timestamps, and flag contradicting pairs. If the newest value is absent from the top-k, accumulation is eating your retrieval and retention policy is the fix. If the newest value is present and the answer still returns the old one, the vote is the problem and a read-time dominance filter is the cheaper change.
Set coverage. Annotate 20 of those questions with the groups of facts needed to answer them, then score whether your retrieved set covers every group. That gives you a coverage number to sit beside your accuracy number, and it is the number MSS-Complement moved.

Five agent-memory papers, September 12–18: poisoned writes, stale majorities, replay audits, and evidence sets