Five agent-memory papers, October 24–30: every operation promises more than it delivers — a preference stored on the wrong user, and an evidence budget that lowers accuracy as it grows (2026)

From October 24 through 30, 2026, five papers in AI agent memory each took one operation that a memory system performs every day and measured what it delivers.

A retrieval set grew from 64 to 512 tokens with the newest statement present every time, and accuracy fell from 45% to 32%. A stored preference kept its content and lost the name of the user it belonged to.

An agent given a cue to return to a dormant conversation found it 100% of the time and replied to it at most 21.4% of the time. Pruning a trajectory cut its token count and, under caching-aware pricing, left no configuration with a lower bill.

The items run in date order, each with the numbers that change a decision, the boundary its authors state, and a check a builder can run.

Raising the evidence budget lowered the score, because an obsolete twin came with it

Date: October 26, 2026

What happened: Oleeviya Babu Poikarayil and six colleagues test the single-hop FactConsolidation split in MemoryAgentBench: 455 statements, 100 questions, 74 of them carrying one older conflicting statement. 1

BM25 ranks statements into an evidence budget of 64, 128, 256 or 512 tokens, restored to chronological order before answering. 1

A gold-assisted audit found the latest statement in all 100 retrieved sets at every budget. 1

On Qwen2.5-7B-Instruct, accuracy fell as the budget grew: 45%, 40%, 36%, 32%. 1

The decline concentrated on conflict questions, 25.7% down to 12.2%. Questions with no older version held at 100% on the smallest budget and 88.5% on the largest. 1

Two four-statement contexts of equal size separate composition from size. Each holds the latest statement plus three unrelated statements; the second swaps one unrelated statement for the obsolete version. 1

Qwen2.5 answered all 74 questions correctly in the first context and 33 in the second, a 55.4-point drop. All 41 questions that changed side changed toward the stale value. 1

Qwen3-14B went from 100% to 87.8%, with all nine harmful flips landing on the stale value. 1

Both models answer Thomas Kyd as the author of The Marriage of Figaro beside unrelated facts, and switch to Pierre Beaumarchais once the older statement takes an unrelated fact's slot, with the newer line still visible. 1

A 32K replication held the direction: 69% on a 64-token budget against 58% on 512. 1

The scope is two open-weight Qwen models at temperature 0, BM25 retrieval, one synthetic benchmark, single-hop chains of at most two statements. These stale values often match ordinary world knowledge while the update contradicts it. 1

Why it matters for builders: A larger evidence budget is usually treated as free precision. Here it delivered the competing version of the same fact, and the reader followed the version it recognized.

Log per question whether an older version of the target sits in the retrieved set, then score conflict and no-conflict questions separately. A healthy average can hide a total loss on every question with a second version.

The fact was correct and ineligible, and storing the governing state bought 9 to 19 points

Date: October 26, 2026

What happened: Yuexi Pan and Yongchao Chen define scientific use validity: whether a remembered fact is eligible to influence a decision, given the state that governed how the fact was produced. 2

Their example is a reported test result. It supports a confirmation when the stopping rule was fixed in advance, and only exploration when the outcome was chosen from twenty results already inspected. 2

SciValidityBench holds 64 task specifications across five validity modules and six scientific domains, each with generated histories and a programmatic decision oracle, and scores 68,320 decisions in all. 2

Its compiler turns a scattered history into decision-governing state, materializing relations such as comparable-with, absent-because and stopped-after in place of the bare sequence. 2

Valid-action rate rose by 18.8, 18.3, 11.3 and 9.2 points over a generic event graph for Qwen3-14B, Gemma-3-12B, Mistral-7B and Phi-3.5-mini, with every interval above zero. 2

An audit that drops 22 tasks with exact state-action overlaps leaves 8.3 to 14.8 points on the remaining 42. 2

The controls locate the gain. BM25 retrieval moved the four readers by −1.4 to +3.0 points, and the event graph carried every public event while staying close to raw. 2

Reader strength sets the ceiling. On pairs that flip one public value and hold everything else, Qwen tracked the declared flip or invariance at 1.000 and Gemma at 0.906, while Mistral reached 0.561 and Phi 0.436. 2

Restoring a damaged governing relation beat an edit-matched repair by 26.9 points for Qwen and 32.8 for Gemma, by 15.0 for Mistral, and moved Phi by −0.3. 2

Why it matters for builders: A record that keeps the result and drops the stopping rule or the comparison set lets the reader take a lucky outcome as evidence. The repair is a field on the record.

Store the governing state beside the fact, then test with paired worlds that change one value. A reader that answers the same on both sides is running on its prior.

Deleting old turns saved tokens and, under cached pricing, raised the bill

Date: October 26, 2026

What happened: Fernando Vallecillos-Ruiz, Islem Bouzenia, Michael Pradel and Leon Moonen delete trajectory content inside Mini-SWE-agent and Trae, on the 100-task subset of SWE-bench Verified with DeepSeek-V4-Flash. 3

Four dimensions vary: what is deleted (reasoning, tool output, or both), whether deletion runs per turn or per token, how much (25% to 100%), and when (immediately or after a two-turn delay). 3

That gives 42 configurations and 9,400 runs across the two agents. 3

With the two-turn delay, 37 of 42 evaluations showed no significant drop in tasks solved. With immediate deletion, 19 of 42 did. 3

Deleting reasoning rarely hurt. Deleting tool output did. 3

The agents covered for what was removed by fetching it again. Deleting tool outputs raised the re-fetch rate to as much as 7.5 times the baseline with the delay, and 10.6 times without it. 3

Execution length grew in 21 of 42 delayed evaluations, and in 34 of 42 immediate ones. 3

The cost result turns on the billing model. Under flat per-token pricing, 26 of the 42 delayed configurations cut estimated cost. 3

Under caching-aware pricing, where a cached input prefix is billed at a lower rate, none of the 42 cut cost and 26 came out significantly more expensive than the uncompressed baseline. 3

Why it matters for builders: A rewrite anywhere in the trajectory breaks the cached prefix for every later turn. The cheap long context behind the policy stops being cheap exactly when the policy removes content.

Price the saving on the invoice you actually pay, and count turns and re-fetch calls beside tokens. Effectiveness survives most of these policies, so the bill decides between them.

A post that names its author, and a memory that dropped whose user the preference belonged to

Date: October 28, 2026

What happened: Agents on social platforms read each other's posts and store the preferences they find. Haoran Bu, Yiting Shen, Litian Zhang, Ruihan Hu and Xi Zhang, at Beijing University of Posts and Telecommunications, show what a quoted conversation does to that store. 4

Two steps produce the misattribution. The attacker attributes its preference to "my owner" rather than to itself, then wraps the line inside a quoted exchange between itself and that owner. 4

When the victim's memory keeps the inner line, it retains the role "user" and drops the environment that bound that role to the attacker's user. 4

The post itself stays honest. Its publisher is correctly attributed to the attacker's agent, and the preference genuinely belongs to that agent's user. 4

The loss lands at storage. Among stored entries carrying the payload, direct misattribution reached 99.0% in Hindsight, 78.1% in Mem0 and 75.7% in A-MEM. 4

Asked to label entries as its own user's or another user's, Mem0 assigned 92.4% to its own user, and A-MEM and Hindsight assigned 100%. 4

Removing either step, the owner framing or the nested quote, lifted correct attribution on Mem0 from 18.3% to over 90%. 4

Tool selection manipulation steered the victim toward an attacker-controlled tool at an average 92.37% success rate. Privacy leakage adds a task-requirement preference so the victim passes sensitive values into that tool, and averaged 69.57%. 4

Five memory systems, A-MEM, LangMem, Mem0, Hindsight and MemOS, ran across six backends, 500 downstream queries per configuration, 15 repeats. With several attack methods live at once, average success reached 78.41%. 4

A security reviewer over the posts called them benign in all five scenario categories at 0.98 to 0.99 confidence, while the comparison attack that rewrites role labels outright was flagged in every review. 4

Why it matters for builders: The write needs the principal as a stored field, and a quoted line is where that field goes missing. Provenance kept on the post does not travel into the preference.

Test it with two-hop quotation. Have one agent post a quoted exchange in which a third party states a preference, then read back what your store says the user wants.

The agent found the dormant conversation every time and returned to it at most a fifth of the time

Date: October 29, 2026

What happened: Sheng Wan and colleagues split re-entry into three capabilities: finding a dormant thread, deciding to return to it unprompted, and reconstructing enough context to continue it. 5

Each of 30 frozen scenarios opens with an exchange and five rounds of unrelated activity, then presents ten conversations, the target among nine distractors. 5

Three branches start from independent copies of that state, so a choice in one cannot change the input to another. 5

Six service configurations ran at temperature 0, with persistent social memory and a resurfacing cue varying independently. The cue notifies the agent and moves the target thread to the first position. 5

With the cue, all six found the target 100% of the time, against 13.3% to 53.3% without it, a risk difference of 46.7 to 86.7 points. 5

Unprompted replies rose with persistent memory, from 0.0-7.7% to 30.0-70.4%, risk differences of 30.0 to 63.7 points. 5

Finding carried little of that into returning. With the cue and no persistent memory, reply rates stayed between 0% and 21.4%. 5

Continuity went the other way. Mean scores were lower with persistent memory in all six configurations, by 0.07 to 0.55 on a 0-to-3 scale, and only Qwen3.5 stayed significant after correction. 5

An exploratory condition whose memory block holds unrelated threads produced reply rates of 33.3% to 60.7%. That beat the no-memory baseline in every configuration and matched the real memory condition in four of six. 5

The distractor blocks run 15% to 22% longer than the real memory blocks, which the authors flag, and the study rests on 30 stimuli with API failures thinning some denominators. 5

Why it matters for builders: Retrieval accuracy, unprompted re-engagement and continuity are three separate numbers. A system tuned on the first can look finished while the third stays flat or slips.

Report them apart. A memory that lifts reply rates without lifting continuity is a longer prompt more than a better memory.

Issue summary

Three patterns run through the five items.

The operation's name did more than its implementation. Retrieval returned the newest statement while accuracy fell as the set grew. A preference kept its content and lost its owner. A cue made the target findable and left returning below a quarter.
Every gap is a missing field rather than a missing module. Which principal stated the record, which state governs its use, which versions sit beside it in the retrieved set, what the prefix cache charges after a rewrite.
The fix has a reader ceiling. Compiled state lifted all four readers and only the strongest used it counterfactually, 1.000 against 0.436. Pruning paid under one pricing model and cost more under the other.

One concrete next action

Add four fields and one audit to the record your system already writes.

Principal. Store who stated each record, keep the path to the original wording, and re-read the store after any nested or forwarded text arrives.
Governing state. On records that license a decision, store the stopping rule and the comparison set beside the result.
Versions in the set. Log per query whether an older version of the target record was retrieved, and score conflict and no-conflict questions separately.
Cost after the rewrite. Recompute per-task cost under your provider's cache pricing, counting re-fetch calls and turns, before shipping any pruning policy.

References