The default 'append every turn, summarize, re-trust' memory design is not neutral storage. Benign, un-attacked growth drifts stored knowledge off ground truth and erodes constraints — the fix is admission control and bounded distilled state, not capacity.
A team ships an agent with long-term memory and watches it get better for the first week. Every session, more gets written: facts the user mentioned, conclusions the agent reached, tool results worth keeping. The store grows, and growth feels like progress — the agent remembers the user’s timezone, the project’s constraints, the thing it learned three sessions ago. This is the whole promise of memory, and early on it delivers.
Then, somewhere past the point anyone is still watching closely, it inverts. The agent starts citing a constraint that was relaxed two weeks ago. It “remembers” a preference the user never stated, confidently, as if it had been told. On a long multi-session task it loses the thread entirely — not because any one session went wrong, but because the accumulated memory it is reasoning from has quietly drifted off the truth. Nobody attacked it. No tool was compromised. The memory just grew, and growing is what broke it.
The instinct, when this happens, is to give it more memory — a bigger store, longer retention, a smarter summarizer to keep up with the volume. That instinct is backwards. The thing that degraded is not capacity. An append-everything-and-summarize design treats storage as free and trust as automatic, and neither is true, so more memory built the default way is more surface for drift. The reliability fix runs the other direction: gate what gets written, bound what is kept, discipline the summaries so the distilled state stays clean. Less memory, kept deliberately, beats more.
This post is about that benign failure — no adversary in it at all — and why the recent literature keeps landing on admission control and bounded distilled state as the lever, not on a bigger box.
Start with what the frameworks actually ship, because the failure is baked into the default. The standard agent-memory loop is: every turn, append the interaction; periodically, summarize the store to keep it manageable; on each new task, retrieve and trust what comes back. There is no gate on the write and no audit on the trust — the store is treated as a faithful record, and retrieval as recall of fact.
Adaptive Memory Admission Control for LLM Agents (arXiv 2603.04549) names exactly what that produces. In their words, agents “either accumulate large volumes of conversational content, including hallucinated or obsolete facts, or depend on opaque, fully LLM-driven memory policies that are costly and difficult to audit.” The store is not a record of what is true — it is a record of what was said, the agent’s own hallucinations written alongside facts and yesterday’s obsolete claims sitting next to today’s, with nothing deciding what deserved to be kept.
That is the crux: no attacker is required for a store to fill with false and stale records, because the agent generates plenty of both on its own and the default writes all of it down. The survey A Survey on the Security of Long-Term Memory in LLM Agents: Toward Mnemonic Sovereignty (arXiv 2604.16548) makes the omission explicit: “the literature concentrates on write- and retrieve-time integrity attacks, while confidentiality, availability, store/forget, and benign-persistence failures remain sparsely studied.” Benign-persistence failure — degradation with no attacker, from persistence alone — is a named, distinct, under-studied mode. The store rotting on its own has gone comparatively unwatched.
The first mechanism is the summarizer — the very thing teams add to control growth. When the store gets large, the standard move is to summarize it: compress a long stretch of interactions into a compact memory, then summarize that again the next time it grows, and again. Each pass is lossy, and the loss is not random — it is directional.
Meta-Cognitive Memory Policy Optimization for Long-Horizon LLM Agents (arXiv 2605.30159) describes the mechanism precisely: as interactions unfold, “ambiguous recursive summaries progressively discard task-relevant information and introduce semantic noise.” Every recompression drops signal — detail the summarizer judged unimportant or could not fit — and adds noise — its own paraphrase, small misreadings, plausible-sounding interpolations. Do it once and the damage is minor. Do it recursively, summary of summary of summary, and the errors are not corrected on the next pass; they are summarized again, hardening into the record. The stored knowledge walks away from ground truth one recompression at a time.
The consequence is not cosmetic. The same paper traces it to the failure that matters: this drift “exacerbates belief deviation, obscuring the agent’s estimate of the latent task state and ultimately derailing long-horizon reasoning.” The agent reasons from its memory. If recursive summarization has corrupted the memory’s picture of the task, the agent’s belief about where it is and what it is doing slides off true, and on a long task that derails the whole trajectory. The survey Governing Evolving Memory in LLM Agents (arXiv 2603.11768) attributes the rot to the same source — its governance machinery is meant to “prevent semantic drift where knowledge degrades through iterative summarization.” Iterative summarization is not a neutral compression step; it is the channel through which benign drift enters, named by two independent papers as the cause — the summarizer added to tame growth is itself how growth corrupts the record.
The second mechanism does not need a summarizer at all. Even if every stored record were individually true and perfectly preserved, the sheer accumulation of true-but-stale and true-but-low-utility records degrades the agent — because retrieval has to find the relevant fact inside an ever-larger pile, and the pile actively interferes.
Novel Memory Forgetting Techniques for Autonomous AI Agents (arXiv 2604.02280) states the benign cause flatly: “Long-horizon conversational agents require persistent memory for coherent reasoning, yet uncontrolled accumulation causes temporal decay and false memory propagation.” Uncontrolled accumulation — not a poisoned write, not an attack — is the named cause. And the paper puts numbers on how hard the degradation curve falls: “benchmarks such as LOCOMO and LOCCO report performance degradation from 0.455 to 0.05 across stages.” That is roughly an order of magnitude lost as the stages pile up and the memory grows unbounded. Not a gentle slope. A collapse.
The false-memory effect is measured too. Under persistent, unbounded retention, the same work reports “MultiWOZ shows 78.2% accuracy with 6.8% false memory rate” — almost one in fourteen recalled items is a memory the agent treats as fact and that is not. It is reasoning over a bloated store, where stale and low-utility records crowd the relevant one and get pulled in alongside or instead of it. CraniMem (arXiv 2603.15642) names why that bloat hurts on clean inputs: many agent memory systems “behave like external databases with ad hoc read/write rules, which can yield unstable retention, limited consolidation, and vulnerability to distractor content.” A large unbounded store is, by construction, thick with distractors — material semantically near the current task but not actually relevant — and the bigger the store, the more of them retrieval wades through. Bloat is its own attack, no adversary required.
This is the cross-session version of a disease that also runs inside a single window: a long context window degrades an agent as it fills — recall drops, distractors mislead, stale state interferes — which is the context-rot story for live runs. These memory papers establish that the long-term store rots as it grows for the same reasons, across sessions rather than within one.
Every paper that diagnoses the benign failure prescribes the same cure, and it is the opposite of “more memory.” The lever is to gate what gets in and bound what is kept — to make admission a decision rather than a default.
Adaptive Memory Admission Control (arXiv 2603.04549) frames memory admission as “a structured decision problem” and decomposes a candidate memory’s value into five interpretable factors before deciding to keep it: “future utility, factual confidence, semantic novelty, temporal recency, and content type prior.” That is what an admission policy decides on — not “did the agent see this,” but “is this worth keeping, by these named criteria.” The payoff breaks the bigger-is-better instinct: A-MAC “achieves a superior precision-recall tradeoff, improving F1 to 0.583 while reducing latency by 31% compared to state-of-the-art LLM-native memory systems.” Keep less, keep it deliberately, and the agent gets both more accurate and faster — which the paper states as “a critical design principle for scalable and reliable memory in LLM-based agents,” not a tuning knob.
Forgetting is the same lever from the other side. Novel Memory Forgetting Techniques (arXiv 2604.02280) shows that “structured forgetting preserves reasoning performance while preventing unbounded memory growth in extended conversational settings” — and does it “without increasing context usage.” The agent recovers reasoning and sheds false memories not by being given more room, but by being made to forget on purpose. Bounding the store is not a cost paid for efficiency; it is the reliability fix.
Bounded, gated designs put numbers on the win. Multi-Layered Memory Architectures for LLM Agents (arXiv 2603.29194) “controls cross-session drift while maintaining bounded context growth,” and under that regime reports “reducing false memory rate to 5.1% and context usage to 58.40%” while still “achieving 46.85 Success Rate, 0.618 overall F1 with 0.594 multi-hop F1, and 56.90% six-period retention.” Fewer false memories, far less context, better retention and reasoning — the bounded system out-remembers the unbounded one. CraniMem’s mechanism for the same result is active pruning — its “scheduled consolidation loop replays high utility traces into the graph while pruning low utility items, keeping memory growth in check,” and that smaller store is what proves “more robust than a Vanilla RAG and Mem0 baseline” under distraction. Making the store smaller is what buys the robustness.
The summarization failure has its own targeted fix, which is not “summarize less” but “summarize for clarity.” MMPO, from Meta-Cognitive Memory Policy Optimization (arXiv 2605.30159), introduces “Belief Entropy, a self-supervised proxy that probes how uncertain the model remains about the latent task state given its current memory,” and optimizes the policy by “penalizing summaries that induce high epistemic uncertainty.” It disciplines the distilled state on whether the summary leaves the agent clear about the task, not on how much was kept. The result should end the capacity argument: a policy held to clarity maintains “97.1% performance even when scaled to 1.75M-token contexts” — controlling drift, not adding room, is what scales long-horizon reliability.
The governance survey closes the loop. Toward Mnemonic Sovereignty (arXiv 2604.16548) reframes reliable memory as “verifiable, recoverable governance over what may be written, who may read, when updates are authorized, and which states may be forgotten” — admission and forgetting, named as the controls — and reports that “no published architecture covers all nine governance primitives we identify.” The default “add memory” design does not leave these controls partially implemented; it leaves them out. That is why the capacity instinct fails: it scales the one thing that does not help and skips the things that do.
The clean claim — “more memory makes it less reliable” — is the easiest kind to overstate, so here is the boundary. It is not “memory is bad,” and it is not “forget aggressively and you win for free.”
The first limit: more memory is not strictly worse, and none of these papers say it is. Every one of them keeps a memory store — the argument is about the policy governing the store, not its existence. A bounded, gated memory routinely beats both a tiny memory and an unbounded one. The failure is specific to the default uncontrolled growth, not to capacity as such: at a fixed, sensible policy, having the relevant fact available beats not having it. The claim is that the default policy converts additional capacity into additional drift — not that recall is worthless.
The second limit cuts the other way and is the more dangerous one: forgetting is not free. The whole reason the admission papers decompose value into multiple factors — future utility, factual confidence, novelty, recency, content type — is that a crude gate throws away facts that turn out to matter, and a crude forgetter deletes the constraint the agent needed three sessions later. Admission control is a precision-recall tradeoff, stated as one: A-MAC’s result is an F1 of 0.583, a balance of keeping the useful and dropping the rest, not a recall score you maximize by forgetting everything. Tune the gate too tight and you have rebuilt the no-memory agent the store was supposed to replace. The cost of dropping a record is borne later and silently, exactly like the cost of keeping a bad one.
Third, the strongest numbers here are benchmark numbers. The collapse from 0.455 to 0.05, the 97.1% held at 1.75M tokens, the 5.1% false-memory rate — these are measured on LOCOMO, LOCCO, MultiWOZ, and the like: long-horizon conversational and task benchmarks, not your workload. The shape is robust and named by independent groups: uncontrolled growth drifts and bloats, and admission control and bounded distilled state recover reliability. The exact altitude of the curve is yours to measure. Across agent traces we’ve reviewed, unbounded memory tends to fail the way these papers describe — confident recall of a stale or never-stated fact, on a long task, with no single session that looks wrong — but treat the specific figures as direction, not as a guarantee for your own agent.
One scoping note, because it is easy to file this under the wrong problem. This is not a threat model. A poisoned write that gets laundered through consolidation and re-trusted is a real and separate failure with an adversary in it; a tiered memory service with an explicit write/forget/consolidate lifecycle is an architecture proposal worth its own treatment. This post is the adversary-free case: benign, un-attacked growth, degrading reliability on its own. The fixes rhyme — gate the write, bound the store, do not re-trust blindly — but the cause here is accumulation and recompression, not malice. You need the controls even if no one is attacking you, because the agent’s own hallucinations and yesterday’s true facts are enough to rot the store.
Before you trust an agent’s long-term memory:
When you can check all eight, the memory is governed. Until then it is just accumulating, and accumulation is the failure.
The bigger-memory instinct treats storage as free and recall as faithful, and it is wrong on both counts: the default append-everything-and-summarize design converts capacity into drift, because hallucinations and stale facts get written down, recursive summaries walk the record off ground truth, and bloat buries the fact you needed under the ones you didn’t. The reliability lever is the opposite move — gate the write, bound the store, keep the distilled state clean. Build memory you are willing to forget from, because the alternative is an agent that confidently remembers things that were never true.
A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.
17 min →
Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.
14 min →
The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.
13 min →