Agent memory

A language model is stateless between calls: everything it "knows" about a user or project at inference time is either in its weights or in the tokens of the current request. Agent memory is the application-layer machinery that closes that gap. The CoALA framework (Sumers et al., 2023) borrows cognitive-science labels that are now common: working memory is the live context window, episodic memory stores records of past interactions or trajectories, semantic memory stores extracted facts ("the build uses pnpm"), and procedural memory stores how-to knowledge, which in practice means prompts, rules files and reusable skills. Writes happen either explicitly (the model calls a memory tool such as create, update or delete) or implicitly, when a background process summarises a finished session and extracts candidate facts.

Retrieval is where most of the engineering lives. Generative Agents (Park et al., 2023) scored each memory as a weighted sum of recency (exponential decay since last access), importance (a 1-10 score assigned by the model at write time) and relevance (embedding similarity to the current query), and periodically synthesised higher-level "reflections". MemGPT (Packer et al., 2023) treated the context window like RAM in an operating system, paging data in and out of external recall and archival storage through function calls. Simpler production designs skip embeddings entirely: Claude Code's auto memory, for example, keeps a MEMORY.md index plus topic files per repository and loads only the first 200 lines or 25 KB of the index at session start, reading topic files on demand.

The hard problems are consolidation and staleness. A memory store that only appends accumulates contradictions ("tests use Jest" and later "tests use Vitest"), and retrieval by similarity will happily surface both. Good designs deduplicate, timestamp and attribute each entry, let newer facts supersede older ones, and cap what is injected so memory does not crowd out the task. Unlike retrieval-augmented generation, whose corpus is curated by people, agent memory is written by the model itself, so errors compound.

Security and privacy follow from that write path. Indirect prompt injection that reaches a memory tool becomes persistent: in 2024 Johann Rehberger showed that a malicious document could plant false memories in ChatGPT's memory feature that then influenced every later conversation, and OWASP's agentic threat guidance lists memory poisoning as a distinct threat. Mitigations include restricting memory writes to trusted turns, showing users what was saved, provenance tags, and periodic review. Where memories contain personal data, GDPR applies in full: storage limitation (Art. 5(1)(e)), the right to erasure (Art. 17) and access requests (Art. 15) all require that stored memories can be found, exported and deleted per data subject.