Agent memory becomes a control plane: five developments, August 22–28, 2026

The August 22–28, 2026 window pushed agent memory further away from passive storage. Five new papers treat memory as a control layer: it decides which experience earns trust, which outside content may enter, which rules survive compaction, which lessons can change future behavior, and whether a finished answer remains supported after the working context disappears. 1 2 3 4 5

MemGuard keeps verifier signals attached to memory

Date: August 22, 2026

What happened: MemGuard turns verifier output into persistent metadata instead of using a verifier as a one-time admission filter. Each memory candidate carries a reward, confidence, verifier label, and verification-time signal. The framework uses those fields during admission, retrieval, conflict resolution, summarization, and archival. High-uncertainty trajectories receive another check. Failure memories follow a separate guard path and are stored as constraints rather than action recipes. 1

The evaluation ran continuous task streams on Terminal-Bench 2.0, SWE-Bench Verified, WebArena, and Mind2Web. Four model backbones, matched task and context budgets, and five random seeds were used. MemGuard reached the best primary success metric and the lowest average step count in all 16 model–benchmark settings. Against ReasoningBank, the strongest prior memory baseline, its largest success-rate gain was 7.9 points on WebArena. A verifier-only filter improved on ReasoningBank in 15 of 16 settings, while MemGuard beat that control in all 16. The added cost was 1,000–2,500 tokens and 5.1–15.0 seconds per task over no memory, while the reduced step count made MemGuard cheaper than ReasoningBank in the reported comparison. 1

Why it matters for builders: A memory pipeline needs a record of why an item was admitted and how much confidence the agent has in it. That record can influence later retrieval and conflict handling instead of disappearing after the write decision. The paper's manual audit found 83–86% agreement between verifier decisions and human judgments, so verifier metadata lowers risk without making memory authoritative. Start by storing confidence, evidence time, and verification outcome with every durable item. Then test whether stale or low-confidence memories are actually down-ranked during retrieval.

MEMORY Wins All makes ingestion a security boundary

Date: August 22, 2026

What happened: MEMORY Wins All describes an indirect bias-injection attack that reaches persistent memory through ordinary social-media content. The attacker cannot read or write the victim's memory, issue queries, alter the runtime, or execute code. Instead, the attacker posts crafted comments and supplies a benign-looking summarization skill that controls which content enters memory. The skill uses semantic cloaking to resemble the surrounding feed, a statistical watermark to make selected comments easier for the curation process to find, and category anchoring to turn the content into structured memory records. 2

The authors evaluated 6,000 crafted comments and 120 emails in a private simulated social network with 10 users. The attack produced a 91.2% average adversary-aligned response rate across four downstream tasks and seven language models, including GPT-5.5, where the average was 86.6%. The curation watermark detected 95.9% of injected comments, while the average Detoxify toxicity score stayed below 0.0023 and only two comments were flagged. The attack required the victim to install the third-party skill, which keeps the threat model narrower than a direct memory compromise. 2

The proposed memory-boundary filter detected 80.6% of injected entries with a 5.6% false-positive rate. Detection fell to 63.0% for political content and 69.3% for advertisements. Strong factual priors also mattered: injected content aligned with a strong prior 100% of the time in the reported test, while conflicting injections aligned 28% of the time. 2

Why it matters for builders: The trust boundary sits before the memory database. External feeds, web pages, email, and third-party skills can influence what the agent later treats as user-specific context. A production design should record source, provenance, curation policy, and confidence before promotion. The first security test is a provenance test: feed the agent plausible but adversarial content, then check whether the final memory entry preserves where it came from and whether the agent can refuse promotion.

The Compaction Cliff separates rules from recollection

Date: August 24, 2026

What happened: The Compaction Cliff measures how repeated context compaction damages safety rules. In the authors' test of Claude Code's /compact on Sonnet 4.6, one round preserved 53% of safety rules and five rounds preserved 10%. The paper proposes Knowledge Triage, which classifies working-set items as Constraint, Procedural, Belief, Preference, or Episodic. TypeCompact keeps constraints and procedures at full fidelity, compresses beliefs and preferences, and reduces episodic items to placeholders. A deterministic verifier checks whether each constraint's canonical form survives; failed checks restore the original or mark the result unsafe. 3

At 50%, 25%, and 10% compression, TypeCompact reached constraint recall of 1.00, 0.95, and 0.80. Type-blind baselines reached at best 0.53, 0.39, and 0.24. From the second round onward, TypeCompact stabilized at 0.96 constraint recall. Its type-aware retrieval reached 96% recall@20 and 100% recall@50 without LLM tokens per query, compared with 61% and 73% for the strongest single-shot LLM retriever. In SafetyMed, TypeCompact achieved 97.0% task pass and 95.5% constraint preservation, compared with 92.5% and 81.0% for Sonnet's compactor. 3

The safety claim depends on classifier recall. The paper reports a residual miss rate of about 7% for its SafetyMargin classifier, and the classifier must be refitted when the corpus changes. Type decomposition also had uneven overhead: the median replication cost was zero, while the worst case reached 219%. 3

Why it matters for builders: A single compression ratio hides unequal damage. A forgotten preference is inconvenient; a weakened constraint changes what the agent is allowed to do. Store memory types explicitly, pin constraints and procedures, and make compaction return a verifiable status rather than a best-effort summary. A practical regression is to run the same safety cases through five successive compaction rounds and check the canonical rule after every round.

Recuris makes memory evolution a gated patch process

Date: August 25, 2026

What happened: Recuris separates a long-horizon agent's memory-control layer into four patchable parts: experiential memory, a working-memory specification, an invocation policy, and a checker set. Working memory tracks goal states such as pending, done, and blocked. Structured traces connect the current state, invoked skills, actions, observations, proposed updates, checker decisions, and outcomes. A fixed meta-agent uses those traces to localize a failure to one component. A candidate patch must repair the failed task and avoid regressions on held-out development tasks before the patch enters memory. 4

Across four long-horizon benchmarks and 10 models, Recuris improved success in 35 of 37 completed model–benchmark pairs. The reported gains include 17.8 points for GPT-5.6 Sol on τ²-Retail, 15.6 points for Claude Opus 5 on the same benchmark, and 16.6 points for Qwen3.6-27B on SkillFlow. The advantage reached 32.2 points on the longest tasks, and common long-horizon failures fell by up to 80%. Structured traces localized failures with 64.8% accuracy, compared with 13.0% from task outcome alone and 37.0% from raw trajectories. 4

The result has a useful boundary. On Terminal-Bench 2.1, retrying within a four-attempt budget raised success from 30 of 87 tasks to 51 of 87. After matching that retry budget, memory learning added 2.3 points, with p=0.774. The benchmark admitted no cross-task patch in 13 runs because its tasks lacked shared structure. 4

Why it matters for builders: Self-improvement becomes easier to audit when a failed behavior points to a specific memory-control component. Keep the base model, checker, and validation gate fixed while testing one patch at a time. The prerequisite is a trace that records state transitions and checker decisions, not just the final answer. The first useful measurement is held-out regression: did the new memory repair the target failure while leaving unrelated tasks unchanged?

AWM asks whether working memory survives context removal

Date: August 26, 2026

What happened: AWM introduces memory-only answerability for long-document visual question answering. After an agent finishes inspecting documents, a frozen reader receives only the question and the agent's terminal working memory. The reader no longer sees page images or the original trajectory. The benchmark records whether the final answer is correct and whether the terminal memory alone supports a correct answer. The difference is called memory-missing correct: the agent got the answer, but its written memory cannot reproduce it. 5

On a 500-example evidence-page-given subset of MMLongBench-Doc, 42.5% of correct answers failed memory-only answerability. AWM-GRPO adds that signal to the training reward while preserving final-answer priority. On MMLongBench-Doc, AWM-GRPO reached 53.9% final-answer accuracy, 8.1 points above the RAG Top-3 baseline. On LongDocURL, it reached 60.1%, 11.9 points above RAG Top-3. In the full multi-turn MMLongBench-Doc setting, AWM-GRPO reduced the memory-missing-correct rate to 17.2%, compared with 19.9% for answer-only GRPO. 5

The diagnostic adds an evaluation pass rather than a deployment-time call. Its current evidence comes from Qwen3-VL-4B, a frozen Qwen3-14B reader, and two document benchmarks. The paper did not test whether another reader would score the same memory equally, and memory-only answerability measures support for the answer rather than complete source-grounding verification. 5

Why it matters for builders: A final answer can be correct because hidden page context is still available, while the persisted memory remains too vague for the next turn. Evaluate the artifact that future turns will actually receive. Remove the original evidence, ask a separate reader to answer from terminal memory, and report the memory-missing correct rate beside final-answer accuracy.

Issue summary

Three patterns connect these papers through their mechanisms and controls:

Memory is an action policy. MemGuard carries confidence and verifier state into later lifecycle decisions. MEMORY Wins All attacks the promotion step before storage. Recuris separates invocation, checking, and updates into components that can be patched. 1 2 4
Transformations need invariants. The Compaction Cliff preserves canonical constraints through summarization. AWM checks whether the terminal artifact still carries answer-supporting evidence after pages disappear. Both move evaluation from the original context to the transformed memory that future steps consume. 3 5
Runtime behavior is replacing retrieval alone as the test target. MemGuard measures task success and step count in continuous streams. Recuris measures held-out repair and failure localization. MEMORY Wins All measures downstream behavioral steering, while AWM measures whether stored memory can support an answer after context removal. 1 2 4 5

One concrete next action

Add four checks to the agent you already run before adding another retrieval layer:

Admission: Attach source, confidence, verification result, and age to every durable memory. Re-run retrieval with a stale low-confidence item and measure whether the item is down-ranked or rechecked.
Ingestion security: Feed the agent plausible external content with a known provenance trail. Measure promotion rate, source retention, and false-positive rejection.
Compaction: Run five successive compaction rounds on a fixture containing constraints, procedures, preferences, and episode details. Verify the canonical constraints after every round.
Memory-only support: Remove the original evidence after a task. Ask a separate reader to answer from terminal memory and record final-answer accuracy, memory-only accuracy, and memory-missing correct rate.

These four measurements tell you whether the next bottleneck is trust at write time, unsafe ingestion, loss during transformation, or a working-memory artifact that cannot support future reasoning. That diagnosis is more useful than another aggregate retrieval score because each result points to a different part of the agent you can change.

References

1
MemGuard: Persisting Verifier Signals for LLM-Agent Memory Governance
arxiv.org
2
MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Feeds
arxiv.org
3
The Compaction Cliff in Long-Running AI Agent Memory
arxiv.org
4
Recursive Experiential–Working Memory Evolution for Long-Horizon Agent Harnesses
arxiv.org
5
AWM: Answerable Working Memory for Long-Document VQA Agents
arxiv.org