What moved in agent memory: poisoning, live records, and longer evals (2026)

Long-context windows keep getting larger. That is not what moved agent memory in July and early August 2026.

What moved was the systems layer around the model: how agents write durable state, what they retrieve, how they evaluate those choices, and what happens when poisoned facts land in the store. The six developments below are the ones that matter most for builders between 2026-07-01 and 2026-08-19.

Memory poisoning becomes a concrete attack surface

On 6 Jul 2026, researchers published GhostWriter, a two-phase memory-poisoning attack against tool-using personal agents with long-term memory.1

The attack first injects a hidden payload into the agent's memory store, then waits for a later retrieval to activate it. Against state-of-the-art agents, GhostWriter reports roughly 98% injection success and about 60% average activation. The same paper proposes AM-Sentry: a write-time memory-saving policy plus a retrieval-time screen that cuts attack success while keeping useful recall.

Why it matters: once memory outlives a session, every untrusted email, web page, or tool result is a write path. If your agent stores preferences, credentials, or procedural notes from outside content, treat write admission and retrieval filtering as product requirements, not later hardening.

Claude swaps daily summaries for live memory entries

Anthropic's 10 Jul 2026 Claude Apps release note says Claude memory now works as individual, categorized entries that Claude reads and updates during conversations, replacing the earlier daily memory summary.2

Anthropic's support docs pair that change with chat search: Claude can search prior chats and surface matching excerpts as tool-style results, while project memory stays scoped to a project and is not shared across projects.3 Users can also edit or delete individual memory items in Settings.

Why it matters: the interesting product move is structural, not "Claude remembers more." Discrete typed records plus on-demand search beat one opaque daily digest when you need to inspect, edit, or isolate what the agent thinks it knows.

Oracle treats agent memory as a database workload

On 14 Jul 2026, Oracle researchers published a technical report framing agent memory as an enterprise substrate on Oracle Database.4

The report organizes the problem as a lifecycle — ingestion, extraction, consolidation, retrieval, summarization, revision or removal — with explicit scope across users, agents, and threads. On LongMemEval it reports 93.8% accuracy while using about 10.7× fewer tokens than flat-history baselines.

Why it matters: if you are past a demo agent, the hard questions are scope control, revision, latency, and token cost under multi-tenant constraints. This paper is useful even if you never touch Oracle, because it states those questions as systems requirements instead of RAG feature checklists.

Retrieval fails when the query never looks like the fact

On 27 Jul 2026, the InMind benchmark targeted what its authors call the implicit-association blind spot: a stored fact can be decisive even when it shares no lexical cue with the query.5

Example shape: a tree-nut allergy should change the answer to a macaron request because of almond flour, yet the texts do not look alike to a retriever. InMind has 125 expert-verified tasks across ten life domains. With the decisive memory forced into context, the backbone answers 84.0% of indirect queries. When the same memory must be retrieved, six vector, graph, and agentic memory systems reach at most 14.4%, even though they can recall those facts on direct queries at up to 100%.

Why it matters: "better embeddings" will not close a gap this large. Production memory needs a second mechanism — routing, always-visible critical facts, or anticipation — for associations the query will never surface.

NVIDIA's NOOA harness makes memory part of the runtime

Also on 27 Jul 2026, NVIDIA Labs published six harness capabilities that raise agent performance on hard environments, including long-term memory.6

In their Object-Oriented Agents (NOOA) harness, the agent actively curates a SQLite memory store, builds a typed knowledge graph, and runs background reflection. Context is passed by reference instead of dumping full histories into every prompt. On ARC-AGI-3, NOOA's curated memory beat file-based note-taking by 11.8 percentage points; the broader six-capability stack reached 55.9%. NVIDIA released the work publicly under NVIDIA Labs Object-Oriented Agents.

Why it matters: memory here is not a sidecar database you bolt on after the agent loop. It is part of the harness contract — write policies, typed state, and what the model is allowed to see on the next turn.

A public leaderboard finally standardizes agent-memory evals

On 29 Jul 2026, the Agent Memory Challenge / Agent Memory Leaderboard launched with a public GitHub repo and competition site.7

The protocol is deliberately small: an Add interface to write memories and a Search interface to retrieve them. Results are version-pinned, private held-out data blocks overfitting, and open-method versus commercial systems are ranked separately. The textual track spans 10+ datasets and about 5,000 questions, including LoCoMo-Refined, BEAM, and LongMemEval. A coding-memory track covers 12 repositories and 1,290 historical coding tasks.

A related July result sharpens why longer horizons matter. Ground Truth First (submitted 24 Jul 2026) builds questions from seeded life-script facts with validity intervals, then shows memory-architecture rankings invert between three-week and nine-week histories: a budgeted curated map that leads early loses recall after eviction, while a provenance-typed graph rises.8

Why it matters: vendor blog scores on one dataset are no longer enough to pick a memory layer. If you ship long-running agents, evaluate against a shared protocol and at more than one history length.

What to watch next

Three patterns run through this window:

Write path governance — GhostWriter and Claude's editable entries both put pressure on what gets admitted and who can change it.
Working-set design — InMind and NOOA point at the same failure: dumping more text into context, or retrieving only by similarity, is not enough.
Longer-horizon evaluation — AML and Ground Truth First make short-window leaderboards look optimistic.

If you are choosing or rebuilding an agent memory stack now, start with write admission, scope, and a benchmark that matches your real tenure — not with another vector index.