Agent memory: what changed in three years of research

Agent memory research grew from 91 papers in 2023 to 2,233 in 2026, and memory turned from a feature of single systems into infrastructure that agents call, write to and defend. The approaches with the strongest evidence are simple: keep the raw history, spend effort on retrieval, version facts that change, and bind every record to its origin at write time. Two problems are open. Memory poisoning reached 81.7 percent cross-session success against Claude Code, and no tested system passes more than 1.5 percent of forget requests.

Claude Haiku 5.5 picked these 3,283 papers out of 15,603 Semantic Scholar abstracts, with data up to 21 October 2026. A number in brackets after a paper’s title is its citation count on that date.

Key findings

• Papers on memory in LLMs and agents: 91 in 2023, 215 in 2024, 744 in 2025 and 2,233 in 2026, counted through 21 October.
• Agents now call memory as tools, and RL trains when they call them. Self-evolving agents went from 2.3 percent of papers in 2024 to 9.8 percent in 2026.
• Papers justify forgetting by stale facts. Forgetting co-occurs with staleness 2.5 times more often than chance, and with cost and latency only 1.35 times.
• Writing to memory became its own problem, with its own term, admission control. Admission and governance appear in 10.2 percent of 2026 papers against 1.9 percent in 2024.
• Persistent memory became an attack channel. Papers on attacks and defences grew from 14 in 2024 to 429 in 2026.
• Retrieval over the raw history, BM25 and a full context often match elaborate memory systems. The retrieval method moves accuracy by 20 points and the write strategy by 3 to 8.
• An agent given a memory store already filled with what it needed made 0 memory calls in 114 turns.
• Evaluation is fragmented. Abstracts named 324 unique benchmarks in 2026, and LoCoMo, the one most papers report, started to saturate.

What did agent memory research look like in 2023?

In 2023 agent memory was a technique built into one system at a time. The most cited paper in the corpus is about GPU memory: Efficient Memory Management for LLM Serving with PagedAttention, with 9,295 citations, from September 2023. Its “memory management” means the KV cache, pages and fragmentation on a GPU. That is the meaning the term started with.

These were the most cited papers of 2023:

The 2023 numbers rest on 91 papers, so read them as direction only. Retrieval came up in 35.2 percent of papers, working memory in 11.0 percent, long horizon in 6.6 percent, and poisoning in none.

By 2026 retrieval was at 54.2 percent, working memory at 4.4 percent and long horizon at 22.5 percent. Retrieval and working memory moved in one direction every year. Long horizon stood still until 2025, at 5.6 percent in 2024, then grew fourfold in two years.

The vocabulary changed with it. Nine words did not appear once in the 306 papers from 2023 and 2024: substrate, typed, stale, cross-session, writes, reusable, brittle, kv-cache, auditable. In 2026 each of them appears in dozens of papers, from 28 for brittle to 222 for reusable. People use words like these for a system layer they have to maintain.

How do agents use memory in 2026?

In 2026 agents call memory as a set of tools, and RL trains the policy that decides when. AgeMem, from Agentic Memory (83), exposes long-term and short-term memory as tool actions in one policy. The agent decides what to store, retrieve, update, summarise and discard. MemSkill (152) makes the retrieval operations themselves trainable skills. It is the agent-skills idea applied to memory.

The pair procedural memory and self-evolution co-occurs 3.3 times more often than chance, the strongest pair in the field. The two concepts appeared together in 2 papers in 2024, 5 in 2025 and 61 in 2026.

Harness Updating Is Not Harness Benefit (36) complicates this. It separates two abilities: writing useful updates to memory and skills, and using them. The first barely depends on model strength. Updates written by Qwen3.5-9B give roughly the same gain as updates from Claude Opus 4.6.

The second ability does depend on model strength, though not in a straight line. Weak models gain little, mid-sized models gain the most, and strong models gain less than mid-sized ones. The authors advise putting the capability into the agent that does the task. The agent that updates memory can be small.

Who decides about memory. For every system paper, Claude Haiku 5.5 recorded who decides what to write, retrieve and discard. The share of systems where the LLM decides, through the prompt or a tool call, peaked in 2025 and started to fall. Trained policies and fixed rules are growing.

The remaining systems don’t say in the abstract who makes memory decisions.

Why do agents forget?

Papers in 2026 clean memory so that the agent does not act on a revoked fact, and the budget is a minor reason. Forgetting co-occurs with staleness 2.5 times more often than chance, on 48 shared papers in 2026 and 9 in 2025. Its link with cost and latency is close to random at 1.35×, even though it rests on more shared papers, 65.

We can’t tell whether it used to be the other way round, because in 2024 the core set has only 14 papers on forgetting.

We computed the concept graph separately for each year. For each concept the table shows what it most often appears with in the same paper, how many times more often than chance, and how many shared papers that rests on. There is no 2023 column, because with 91 papers the concept pairs barely share any. “None” means no pair above the threshold of 6 shared papers.

The 2024 column rests on six shared papers and 2025 on 8 to 26. Only 2026 has enough to read with confidence. For the earlier years, trust the direction only.

Stale memory produced its own kind of benchmark. STALE (50) introduces implicit conflicts, where a new observation overrides an old record without negating it directly, so only reasoning can detect the conflict. PersistBench (26) tests when long-term memory should be forgotten. FadeMem (14) lets different records decay at different rates. MemoryBank had that idea in 2023, and it stood alone then.

Other papers treat contradictions in memory as a database problem. TOKI (10) argues that resolving contradictions in memory is concurrency control for writes, which production systems already do by feel.

TOKI describes four common heuristics as one family of operators: last-writer-wins, evidence weighting, waiting for confirmation and per-rule policy. Each operator has its own isolation-level requirement and its own provenance mark, which keeps the losing fact in an audit row. A neighbouring paper is called Don’t Ask the LLM to Track Freshness (2), and it proposes a deterministic recipe for exactly that.

Remember, Verify, or Ask? (3) tests the decision at the moment a fact is reused. The agent can store it, use it once, re-check it or ask the user. Models re-check changing facts noticeably more willingly than they ask about ambiguous ones. Qwen without hints asked none of the 12 clarifying questions it needed to ask, and re-checked 12 of 18 facts that were going stale. A policy in the prompt cut wrong memory writes from 24.3 to 10.0 percent.

Why is writing to memory hard?

Writing is hard because facts are extracted in advance, before anyone knows the future tasks, and they are extracted once, without verification. An error written once stays in memory indefinitely, as ProMem (20) puts it. In 2026 writing got its own term borrowed from networking, admission control, which means deciding what gets into memory at all.

In 2023 and 2024 the literature was mostly about reading, meaning how to retrieve the right thing. The pair fact writing and long-term memory did not appear once in those two years, and in 2025 it appeared in 2 papers. In 2026 it reaches 2.1× on 38 papers and is long-term memory’s closest neighbour.

A-MAC (21) splits the value of a write into five factors you can read: future utility, confidence in the fact, novelty, recency and content type. It reaches F1 0.583 on LoCoMo with 31 percent lower latency than memory systems where the LLM decides. The factor that mattered most was content type.

Evidence-Gated Memory Writing (12) writes a fact only when three scores pass their thresholds together. Compared with writing everything, memory contamination drops by 67 to 70 percent and accuracy rises by 6.7 to 8.4 percentage points.

Decision-Sufficient State Representations (3), from September 2026, measures what writing costs. The agent carries a short written state in place of the history, and whatever the writer dropped is gone before anyone needs it. In TextWorld games a 128-token state with the right facts wins almost every game. LLM writers working from a prompt win at most 17 percent.

Almost all of that loss is what the authors call write-time regret, a selection error made at write time. Space was rarely the problem, and the loss grows the longer a fact has to be carried. Training the writer adds 7.0 percentage points of success, but the gain is significant only when the fact is needed soon.

Where memory lives and what happens to it. Storage changed along with writing. The share of records with a fixed schema doubled in two years, memory in model weights halved, and the vector store barely moved. Among operations, revising existing records, consolidation and forgetting all grew, while reading stayed between 81 and 85 percent.

A paper can name several stores and operations, so the columns add up to more than 100 percent.

How is agent memory attacked, and which defences work?

Attackers get untrusted text into an agent’s persistent memory once, and it comes back in later sessions as an instruction. The defences that hold up in measurements bind each record to its origin and keep recalled memory away from execution, and prompt-level filters barely help. Provenance here means the record of where a memory entry came from.

The pair memory poisoning and provenance co-occurs 3.1 times more often than chance. That makes it the third strongest pair in the field, after skills and self-evolution and after admission and provenance. Before 2026 the pair did not appear in a single paper. In 2026 it appears in 27. The word poisoning itself appears in 2 of the 306 papers from 2023 and 2024.

From Storage to Steering (21) shows that memory can take over and force tool calls against a direct instruction from the user. Poison Once, Exploit Forever (25) does the same through a web agent’s environment.

Two mechanisms are described precisely, and both happen during consolidation. Reading memory does not trigger either of them.

Authority collapse. When Memory Becomes Authority (9) shows that consolidation keeps the claim and erases the source’s constraints, which defined how the claim may be used at all. The record ends up meaning more than its source allowed.

Provenance laundering. Memory Provenance Laundering (7) shows that consolidation can rewrite an external observation as if it came from the user’s history or a workflow. The action trigger stays and the low-trust source disappears. The authors note that prompt filters, sanitisers and tool guards fire before consolidation, so they do not hold this boundary.

Four papers tested these mechanisms on real systems:

• When Malicious Instructions Persist (3) attacks two real agent harnesses, OpenClaw and Claude Code. A malicious instruction hides in an external source, the agent writes it to persistent memory itself, and it fires in later sessions. Cross-session attack success is 55.5 percent on OpenClaw and 81.7 percent on Claude Code. Prompt-level defence reduces poisoned writes but barely helps once memory is already poisoned.
• Trojan Hippo Bench (12) plants a sleeper implant in long-term memory through a single untrusted tool call, such as an email. The implant wakes up when the user talks about money, health or personal data. With no defence, attack success is 85 to 100 percent against frontier models from OpenAI and Google, and the implant still fires after 100 ordinary sessions.
• MemPoison (8) has 1,227 manually verified cases. Checks at write time stop direct corruption of a single record well. They miss composite poisoning, where the harm appears only when several harmless records are retrieved together, and sleeper poisoning, which waits for a trigger.
• Silence Is Endorsement (2) looks at handoffs between pipeline stages. A handoff keeps the claim that the action is allowed and loses the mark saying that nobody checked it. Removing that one mark raises the monitor’s approval of risky actions from 5 to 60 percent for Llama-3.1-8B and from 9 to 98 percent for Qwen2.5-14B. Memory compressors often drop this mark.

All four conclude that the origin mark has to travel with the record, because input filters do not hold.

Scale. Among papers on memory and adjacent topics, the number on attacks and defences grew every year:

In 213 of these 539 papers the harmful text reaches the agent through the memory store itself, the most common channel. User messages come second with 52. The most attacked target is OpenClaw with 26 papers, then Mem0 with 6 and Claude Code with 4.

The defences build a chain of custody for each record. MemLineage (19) attaches cryptographic provenance and a lineage graph to every record. It keeps an RFC-6962 Merkle log over Ed25519-signed records, and a weighted DAG records which records influenced each new one. MemMark (18) watermarks records by how state evolves. AgentSys (15) treats bloated working memory as a vulnerability in itself. Isolation alone drops attack success to 2.19 percent.

In Prompt Injection as a Systemic Vulnerability (0), prompt-level defences cut memory poisoning by at most 3.2 percentage points, while tool permissions and provenance tracking bring it from 94 to 11 percent.

Origin-Bound Authority (22) found that defences judging a record by its content or its lineage can be laundered with up to 68 percent success. Binding the origin at write time brings attack success to 0 percent.

ZoneClaw (0) keeps external claims in a low-trust zone, and they gain authority only by crossing an explicit boundary. Successful attacks fall from 372 of 480 runs to 6 of 480, and utility holds in 458 of 480.

Where a defence sits matters more than how good its classifier is. In Injection-Execution Dissociation (3), agents store malicious instructions at rates above 97.5 percent, but execution ranges from 0 to 95 percent depending on whether recalled memory is isolated from execution.

How is agent memory served, and what does it cost?

Serving agent memory became a research topic of its own. Papers about the serving layer were 6.5 percent of memory papers in 2024 and 13.0 percent in 2026. In 2026, 40.1 percent of system papers report at least one figure for cost, latency or tokens.

The topic started in 2023 as hardware memory management with PagedAttention. The question now is how to serve agent memory in production.

Memory tiers get no multiplier. Two papers mention them in 2023 and none in 2024, so the series is too thin.

Hardware is back as well. ITME moves inference onto disaggregated CXL hybrid memory. Pancake (6) builds hierarchical memory for serving many agents at once. SideQuest (11) cuts peak token consumption by up to 65 percent with a model trained on only 215 examples.

DeepSeek-V4.1-Flash (117), from September 2026, states its motive plainly. Long-lived agents made the workload input-heavy, so KV-cache size and memory bandwidth became the bottleneck. The model’s global KV cache is 890 bytes per token, about a quarter of DeepSeek’s previous model. The persistent cache on SSD or in host memory is about an eighth.

Two September papers take generation off the critical path of memory. Jev-Mem (19) and Mnemon (3) split the work in a System 1 and System 2 scheme.

A fast controller makes the small decisions: what type a record has, where to route a query, how much budget retrieval gets, whether a write is needed and whether a record is stale. The LLM is called only for hard reasoning and the answer. In Mnemon the controller is the Jev decision model, which makes dozens of such decisions in a third of a second.

ContextBudget (14) treats context management as a sequence of decisions under a limited budget. Before accepting a new observation, the agent checks the remaining budget and decides when and how much to compress the history.

Who reports the cost. The share of system papers whose abstract gives a cost, latency or token figure grew from 25.0 percent in 2024 to 29.8 percent in 2025 and 40.1 percent in 2026. It depends on who makes memory decisions. Systems where the LLM decides report cost least often.

Compressing the context inside a session has its own price. The Compaction Cliff (2) tested 20 production agent configurations. Claude Code’s /compact on Sonnet 4.6 keeps 53 percent of safety rules after one round of compaction and 10 percent after five. Compaction that handles each line according to its type keeps 96 percent over five rounds.

Lossless designs avoid that trade-off. They evict old content and keep a pointer back to it. In Context as an Environment (4), a context manager that treats the context as a program over the full event log reaches 94.8 percent on LongMemEval_S. A demand-paging proxy in The Missing Memory Hierarchy (8) found that 21.8 percent of input tokens across 857 production sessions are structural waste.

Which memory systems showed measured gains in 2026?

Measured results from 2026 show token savings of 20 to 65 percent, accuracy gains of 6 to 26 percentage points and latency lower by about a third. Gains of that size are worth paying for.

Which new concepts appeared in agent memory research?

The fastest-growing concepts since 2024 are auditability and provenance, memory as a layer, and writing as a separate problem. Each row is the share of abstracts per year that mention the concept, and only concepts we could check against the corpus made the list.

Where 2024 has one or two papers, at 0.5 to 0.9 percent, the multiplier is shaky. The 2025 and 2026 numbers are more reliable.

The agent harness as a research subject. The harness is the runtime around the model. Externalization in LLM Agents (74) finds that agents are increasingly built by restructuring that runtime, its memory, skills, protocols and tools, while the weights stay the same. Code as Agent Harness (48) adds that code in agent systems now carries reasoning, action, environment modelling and verification by execution, on top of being the output. There is even a paper called Harness Engineering as Categorical Architecture.

RRSI (20) shows the downside. A harness that is improved automatically overfits to its own tasks, and the gain outside them shrinks or disappears. Regularising which edits get selected gives up to 6.0 percentage points on its own tasks and up to 4.3 on five unseen ones, and the harness spends 30 percent fewer tokens.

Memory portability. Does Your Agent’s Memory Survive a Model Upgrade?, from September 2026, compares four storage formats across a model change. Memory with a fixed schema transfers almost losslessly, with accuracy changing by +0.0004 ± 0.0020. Notes compressed into natural language are tied to the model and move by +9.91 to −13.28 percentage points depending on the direction of migration.

For notes, 80 percent of the loss happens when they are built. For RAG, 81 percent of the loss comes from retrieval. Repairing notes from inside the store never reached the 90 percent recovery target in any of 48 cases, and the saved raw history reached it in 34 of 48. If you run a platform with memory, keep the raw log and fix the schema.

Runtime-Independent Persistent Agents (2) shows the same on a live agent. An instance kept its identity, memory and task history while moving from Codex to Claude, along with a change of harness and host. The authors limit the claim themselves. They show mechanical continuity and do not claim behavioural equivalence.

Moving memory between vendors. Portable Agent Memory (5) is an open protocol for moving memory between agents from different vendors. It defines a five-component memory model, content-addressed records linked by a provenance Merkle-DAG, capability-based access and a rehydration protocol that resists indirect injection. The authors wrote it because accumulated context is locked inside vendor-specific runtimes.

Five findings that don’t fit a trend

Memory can make agents worse. The Memory Curse (14) gave agents more of their history and found that cooperation got worse in 18 of 28 model and game combinations, across seven models, four games and 500 rounds. Replacing the visible history with synthetic cooperative records of the same length restores cooperation, so the content of the history causes the drop. Removing explicit chain-of-thought often weakens the effect, which means reasoning amplifies it.

Memory-Induced Tool-Drift (3) is a related result. Preferences in memory such as “frugal” or “impatient” quietly shift tool-call parameters where they are irrelevant. The share of corrupted parameters rises to 0.38 to 0.83, against 0.05 to 0.12 with neutral memory, across all eight models tested. An audit of 6,062 tools on 288 MCP servers showed that real tools are vulnerable too.

The most radical claim of the year. Contextual Agentic Memory is a Memo, Not True Memory (14) argues that vector stores, RAG, scratchpads and context window management all amount to search. From that the authors derive a provable ceiling on generalisation to new compositional tasks, which neither a bigger context nor better retrieval fixes, plus a vulnerability to poisoning.

The argument rests on complementary learning systems theory. Humans store examples fast in the hippocampus and consolidate them slowly into the weights of the neocortex. Today’s agents do only the first half.

A memory system designed by AI. Omni-SimpleMem (15) came out of an autonomous research pipeline that ran about 50 experiments with no human in the inner loop and took F1 on LoCoMo from 0.117 to 0.598. The breakdown is the useful part. Bug fixes gave +175 percent, architecture changes +44 percent and prompt work +188 percent on individual categories. Each of these alone was larger than all the hyperparameter tuning combined.

A negative result worth knowing. MEMTIER built a careful multi-signal retrieval layer that turned out to be an ordinary BM25 top-k pass-through. Removing it entirely does not change accuracy. Diagnostics showed why. The right session is among the candidates in 98 percent of cases, and session coverage is 90.9 percent. The bottleneck is what reaches the model, where fact recall@2 is only 4.5 percent. Feeding all facts from the top-k sessions raises multi-session accuracy by 0.120 and knowledge update by 0.205.

Two neighbouring communities do not read each other. Experience Compression Spectrum (17) analysed 1,136 references in 22 key papers. Cross-citation between people building memory systems and people working on skill discovery is below 1 percent, although both extract reusable knowledge from work traces. The authors put memory, skills and rules on one compression axis: 5 to 20× for episodic memory, 50 to 500× for procedural skills and 1,000×+ for declarative rules. None of the 20+ systems they analysed can change its compression level on the fly.

How reliable is agent memory evaluation?

Evaluation is the weakest part of the field. Abstracts named 324 unique benchmarks in 2026, rankings flip when a single component changes, and the share of papers that release code did not grow.

There are too many benchmarks. These are unique names in abstracts and titles, with 2026 counted through 21 October:

Two benchmarks became the common currency. LoCoMo is mentioned in 192 papers from 2026 and LongMemEval in 124. After that the counts fall off a cliff: HotpotQA 28, MemoryAgentBench 17, WebArena 16, everything else 10 or fewer.

LoCoMo is already saturating. MemoryArena (86) links remembering and acting in multi-session tasks with dependent subtasks, and agents that nearly saturated LoCoMo fail there.

Evaluation connects to nothing. The word “benchmark” appears in 45.9 percent of 2026 abstracts and links to no concept above 1.3× chance. It goes with everything, so it tells you nothing about a paper. Its share keeps growing, from 18.7 to 23.3, 33.5 and 45.9 percent between 2023 and 2026. Papers on evaluation doubled their share since 2024 and gained no connections to the rest of the field.

Negative results became more common. Released code did not. We count a paper as negative when a system, a baseline method or a common practice it tests did not work. Their share was 7.9 percent in 2024, 7.0 percent in 2025 and 17.4 percent in 2026.

Two thirds of the 388 negative papers in 2026 are benchmarks and empirical analyses. A negative conclusion appears in 61 percent of new benchmarks and 66 percent of analyses, against 7 percent of systems. In Continual Learning Bench (18), for example, dedicated memory systems did not beat plain in-context learning.

Code or data is released by 19.5 percent of 2024 papers and 16.3 percent of 2026 papers, so there is no growth there. The models in experiments are old. The most common base model in 2026 papers is GPT-4o with 47 papers, then GPT-4o-mini with 29, then Llama-3.1-8B and Qwen3-8B with 28 each.

The field admits its foundation is shaky. Anatomy of Agentic Memory (25) lists the problems. Benchmarks are small, metrics diverge from real usefulness, results depend heavily on the base model, and system overheads usually go uncounted.

The measurement setup confounds results. When Does Memory Help Multi-Trajectory Inference? shows that the inference strategy is a hidden variable. The same memory method gives statistically different results under different strategies on the same examples. Reflection is significant under MCTS and not under best-of-N. Extracting atomic facts leaves accuracy unchanged and shortens trajectories by 19 to 26 percent.

Conclusions flip under controlled comparisons. MemDelta (3) swapped only the embedding model in an otherwise identical pipeline. Accuracy moved by 6.2 percentage points, and the system that looked better changed. In Beyond Memory Leaderboards (0), Graphiti wins convincingly on full-text scientific papers but pulls 2.6M characters of retrieved context per query, and its lead disappears once the retrieval budget is equal.

Ground Truth First (3) shows rankings inverting with history length. Over nine weeks one system’s recall of evicted content fell from 96 to 72 percent, while a provenance-typed graph rose to 90 percent. CrossBench (0) found that open-source SDKs don’t reproduce the scores advertised for managed cloud memory platforms, and that “LoCoMo accuracy” means different things in different papers.

Production finds what the lab misses. Governed Shared Memory (14) is a rare paper that measured a live multi-tenant service and published its negative results. Tenant isolation held. Sub-tenant scope was bypassed by direct GET-by-id requests with agent credentials. A synchronous near-duplicate gate also discarded a contradicting record before the asynchronous contradiction detector got to evaluate it. The authors conclude that long context and retrieval are not enough for production memory in multi-agent systems.

Which agent memory approaches work best?

The approaches with strong evidence are retrieval over the raw history, spending effort on retrieval, typed records where state changes, a log with explicit supersession, and binding each record to its origin at write time. Knowledge graphs and continuous consolidation by an LLM are contested, and deletion on request is unsolved.

We grouped the 2025 and 2026 papers into 22 families of approaches, ranked the papers in each family by the strength of their evidence, and read the strongest abstracts. The ratings are our judgement from those abstracts:

• Strong. Several independent papers measured against a strong baseline such as full context, no memory, retrieval over the raw history or BM25, and at least one of them controlled its factors or pre-registered its hypothesis.
• Medium. Measured, but mostly against weak baselines or on one type of benchmark.
• Contested. Direct negative results, or a gain that disappears when the budget is held equal.

Eight patterns recur across research groups and benchmarks:

1. Simple baselines are strong. Retrieval over the raw history, BM25 and, on short horizons, a full context often match elaborate memory systems.
2. Retrieval matters more than writing. The retrieval method is worth 20 points and the write strategy 3 to 8. A better memory backend gives more than a bigger model.
3. The budget decides. Under tight budgets consolidation and extraction win, and under loose ones raw records do. A graph’s advantage disappears under an equal budget.
4. Structure pays off on changing state. Supersession, aggregates, negation and dependencies need types, versions and explicit supersession links. Plain recall handles none of them.
5. An LLM on the write path adds errors and cost. Extraction hallucinates, hedges turn into confident facts, contradiction resolution produces anomalies, and writes cost thousands of times more than selection.
6. What is kept matters more than how much. In a controlled replication in Shared Selective Persistent Memory (1), selective memory completed 12 of 12 trials at the same token cost at which no memory completed 0 of 12. Full history completed 8 of 12 at twice the cost.
7. Memory can hurt. In MemTrapBench (1), all five memory frameworks did worse than no memory on reasoning traps. In When Memory Lies (2), an agent that trusted stale spatial memory died more than twice as often as the same agent with no memory.
8. Results transfer poorly. Conclusions change between models, embedding models, judges and history lengths. One embedding swap moved accuracy by 6.2 points and changed which system looked better.

How should you build agent memory?

1. Keep the raw log, and fix the schema where state changes. Retrieval over the raw history matches elaborate memory systems. Memory with a fixed schema survived a model change with an accuracy shift of +0.0004. Notes compressed into text moved by +9.91 to −13.28 points, and repair without the original history failed in all 48 cases. On aggregate questions typed state reaches 99 percent, where retrieval collapses to 6 to 43 percent.
2. Spend on retrieval before you spend on writing. The retrieval method moves accuracy by 20 points and the write strategy by 3 to 8. A better memory backend gives more than a larger reader model.
3. Still treat writing as a separate subsystem. Explicit admission gives 31 percent lower latency and 67 to 70 percent less contamination. Almost all the loss of an agent with a short written state comes from what the writer chose to keep.
4. Version changing facts explicitly. A supersession rule in a log with two time axes brings stale answers to about 0 percent. Similarity retrieval serves superseded values 15 to 40 percent of the time.
5. Have the harness deliver memory. Agents don’t ask for it. With a full store the agent made no memory calls in 114 turns, while cue-triggered injection fired every time.
6. Keep rules out of compaction. After five rounds of summarising compaction, 10 percent of safety rules survive.
7. Bind provenance at write time and guard the action boundary. Origin binding at write time brings attack success to 0 percent. Architectural controls bring poisoning from 94 to 11 percent, while prompt-level defences give at most 3.2 points. Both known mechanisms of harm happen at consolidation, which input filters never see.
8. Design forgetting around correctness, and test deletion. Forgetting pairs with staleness at 2.5× and with cost at 1.35×. No system passes more than 1.5 percent of forget requests.
9. Measure cost per query, and compare against simple baselines at an equal budget. Systems where the LLM decides about memory report cost least often, at 31.7 percent. A single embedding swap or an unequal budget can flip a ranking.
10. Spend model budget on the agent that does the work. The quality of memory updates barely depends on the strength of the writer model. How much the executing agent gains from them does depend on its strength, though not in a straight line.

Frequently asked questions

What is the role of memory in an agentic AI?

Memory is the state an LLM agent keeps beyond a single context window: facts, notes, past sessions, skills and rules that it can write, retrieve, update and forget. It lets an agent carry what it learned from one session into the next. In 2026 papers, memory is most often stored as text summaries and notes, in 60.2 percent of papers, followed by typed records in 32.2 percent and raw logs in 27.5 percent.

What are the types of memory in AI agents?

Most papers use the four types from Cognitive Architectures for Language Agents, published in 2023: working, episodic, semantic and procedural memory. Systems such as AgeMem also split memory into short-term and long-term and let the agent manage both through tool calls. In 2026, procedural memory and skills appear in 8.4 percent of papers and working memory in 4.4 percent.

Mem0 vs RAG: which is better?

In the 2026 papers we read, plain RAG matched Mem0 for less money. One comparison found that Mem0 matched cloud RAG on two question types at 50 times the cost. Another found that plain RAG reached Mem0’s accuracy at 8.4 times lower total cost of ownership.

What is the best memory for AI agents?

Rankings change with the setup, so no single system is best everywhere. Swapping only the embedding model moved accuracy by 6.2 percentage points and changed which system looked better. In one comparison Graphiti and cognee reached 55 to 56 percent against 77 to 81 percent for Mem0, RAG and full context. The approaches with strong evidence are retrieval over the raw history, typed records for state that changes, a log with explicit supersession, and origin binding for security.

How to evaluate agent memory?

Most papers report LoCoMo, mentioned in 192 papers in 2026, or LongMemEval, mentioned in 124. LoCoMo is saturating. Agents that nearly saturated it fail on the multi-session tasks of MemoryArena, and “LoCoMo accuracy” is defined differently from paper to paper. Compare systems against retrieval over the raw history at an equal retrieval budget, and report cost per query.

Method and limitations

Corpus. We queried the paper/search/bulk endpoint of the Semantic Scholar Graph API with 35 search phrases on memory and context management, for 2023 to 2026, capped at 10,000 papers per phrase and deduplicated by paperId. That gave 49,640 unique papers. Of them, 15,766 matched a memory-related phrase and have the word memory in the title or abstract. The data runs to 21 October 2026. In 2026 none of the memory-related phrases hit the cap.

Selection by meaning. Most papers that match memory search phrases are about something else, so Claude Haiku 5.5 read the title and abstract of each of the 15,603 papers that have an abstract and filled one schema through direct API calls. The whole pass cost about 3.3 USD. The model declined to label three papers and sorted the rest into three classes:

• core, about memory or context management in LLMs and agents: 3,283 papers
• adjacent, about LLMs but mainly about something else, such as model technical reports, general RAG and long-context architectures: 3,020 papers
• off_topic, about anything other than LLM memory, mostly LSTM models: 9,300 papers

All the numbers come from core papers only. We checked a sample by eye on random titles from each class. The line between core and off_topic is clear. The line between core and adjacent is blurry in places.

October 2026 is incomplete in the data, with 183 papers through the 21st against 270 in September. By month, the 2026 flow went from 141 in January to a peak of 304 in May, and was 270 in September.

How links were computed. Concepts are regular expressions over the title and abstract. The strength of a link is lift, which says how many times more often two concepts appear together than they would if they were independent. The threshold for shared papers scales with the size of the year: 6 for 2023 and 2024, 8 for 2025 and 25 for 2026. In 2023, with 91 papers, almost no pair passes the threshold, so the table of neighbours starts with 2024.

What the method does not see. It counts words. A concept phrased narrowly gets undercounted. For example, “memory operations as agent tools” matched only 7 papers in 2026, although several systems implement the idea in other words. Lift penalises terms that appear everywhere, which is why benchmarks have no links. Co-occurrence does not mean causation.

The 2023 set is small at 91 papers, and 2024 has 215, so shares there are shaky and pair lifts can barely be computed. That is why the tables measure growth from 2024 and show 2023 for direction only.

A model did the selection by meaning, so errors are possible at the core and adjacent boundary. Without it, 60 percent of the papers matched by the search phrases would be noise. Citation counts of 2026 preprints change fast. We checked all citation counts in the article on 21 October 2026 with one batch request to Semantic Scholar.

Field labels. Besides the class, the same pass recorded for each paper the type of work, the memory store, the operations, who makes memory decisions, whether it gives cost figures, negative results, released code, the threat model and named products. These are estimates from the abstract. If the abstract doesn’t state something, the labels can’t see it, so shares such as “reports cost” are a lower bound.

The map of approaches. A second labelling pass by Claude Haiku 5.5 recorded which design questions each of the 2,977 core papers from 2025 and 2026 informs. We grouped the papers into 22 approach families using these labels, the store, operation and controller labels, and keyword rules. Within each family we ranked papers by evidence: measured results, a comparison against a strong baseline, several models or benchmarks, released code and citations.

We read the abstracts of 219 papers, the strongest in each family. We did not read the full texts, so we don’t know the schemas, thresholds and exact comparison conditions, and the evidence ratings are our judgement.