Persistent memory is becoming one of the useful features of AI agents, and one of the more interesting ways for them to fail.

A June study of memory poisoning in LLM agents described the basic problem: information encountered through ordinary channels such as documents, webpages, emails, tool outputs, or user interactions can be written into long-term memory and later retrieved as if it were trusted context. The danger is not confined to the moment when the bad information enters the system. Once stored, it can influence later sessions after the original source has disappeared from view. The study, From Untrusted Input to Trusted Memory, also found that existing prompt-injection defenses do not adequately cover memory poisoning.

A July 31 paper identifies an even subtler version of the problem: provenance laundering. During memory consolidation, an agent may summarize or rewrite an external observation in a way that preserves the useful-looking claim while losing the fact that the claim came from an untrusted source. The content survives. Its origin does not. The paper, Memory Provenance Laundering in LLM Agents, treats preservation of source authority as a security boundary.

That is a security problem, but it is also a very old archival problem in a new form.

An archive is not simply a collection of statements. A serious archive preserves relationships among statements, sources, dates, versions, authors, surrounding records, and the processes by which records entered the collection. Those relationships are part of what makes the material usable as evidence.

This distinction matters whenever information is transformed. A quotation becomes a note. A note becomes a summary. Several summaries become a concept. A concept appears in an answer. Each step can be useful, but each step moves farther from the original record.

If the system keeps only the final abstraction, it may remember the conclusion while forgetting why anyone believed it.

The source trail is part of the knowledge

A trustworthy memory system should be able to answer more than What do we know?

  • Where did this claim come from?
  • What original record supports it?
  • Is this a quotation, an observation, an inference, or a generated summary?
  • What surrounded the statement in the original record?
  • Has the underlying information changed?
  • Who or what changed it?
  • What did the system believe before the change?
  • Did another source disagree?
  • Was the disagreement resolved, or merely hidden by the latest summary?

This is why provenance cannot be reduced to a citation pasted onto the end of a paragraph. Provenance is the history of a piece of information: its source, its transformations, its relationships, and sometimes the record of its correction.

The point is not that provenance makes information true. A false statement can have impeccable provenance. The point is that provenance makes a statement inspectable. It gives the next researcher, reader, or agent some way to discover why the archive contains it and whether the evidence still supports it.

Recent work on persistent agent-memory architecture is converging on surprisingly archival language. A July Internet-Draft on persistent memory in agentic systems proposes typed and versioned memory objects, machine-readable provenance, validation states, immutable logical revisions, and an append-only event ledger. It also draws an important line between authoritative persistent state and derived objects such as embeddings, retrieval indexes, caches, and generated summaries. The document is a work in progress, not an IETF standard.

That is a useful distinction. An embedding can help you find a source. It is not the source. A generated summary can help you understand a document. It is not the document. A conversational answer can be excellent. It is still a derived output.

Context can be part of the information

This becomes especially obvious in social-media archives.

A post does not exist only as a string of text. Its timestamp may matter. The account that published it may matter. Whether it was a reply, quotation, repost, caption, or part of a thread may matter. The post immediately before or after it may change its meaning. So may a deleted parent post, an attached image, the state of the platform at the time, or the fact that an archive captured some surrounding material but not the rest.

Leisa Gibbons's 2026 paper Mediated recordkeeping and epistemic accountability in social media archiving presses on exactly this problem. Digital records arrive in archives through platforms, capture tools, preservation decisions, and institutional practices. Those mediations shape what survives and therefore what the resulting archive can legitimately be used to establish. Gibbons argues that archives need to document not only what was captured but the platform and archival conditions that shaped the record.

The context is not always decoration around the information. Sometimes it is part of the information.

Strip a statement from its surrounding exchange and you may preserve the words while changing what they mean. Preserve a screenshot without its date or account identity and you may keep the image while losing the ability to place it. Preserve only what a platform's export happened to expose and the archive may look complete while silently containing structural absences.

This is one reason archival provenance is more demanding than ordinary citation. A citation can tell you where a sentence came from. Provenance can tell you what kind of record it was, what surrounded it, how it reached the archive, what may be missing, and what happened to it afterward.

That distinction matters for AI memory too. A memory that says only “X happened” may be much less trustworthy than a memory that can also say who asserted X, when, in response to what, from which document or interaction, and through which transformations the claim passed before becoming a stored fact.

Sometimes the archive is part of the evidence

The importance of this becomes obvious when sources disagree.

The Apollo 11 research archive keeps original NASA documents, compiled source notes, concept articles, and research outputs separately. One of those outputs is a discrepancy ledger: a running register of places where the primary record gives incompatible values for the same fact.

The archive does not simply choose the cleanest number and delete the mess.

For example, different Apollo 11 records give different distances between the Lunar Module and West Crater. Later Lunar Reconnaissance Orbiter imagery can adjudicate much of that conflict. Other disagreements in the archive cannot be settled from the available evidence and remain explicitly unresolved.

That unresolved status is itself information.

A system that silently normalizes every conflict may produce cleaner answers while preserving less knowledge. The existence of two incompatible records, their dates, their contexts, and the later attempt to adjudicate them can matter as much as whichever number eventually lands in the current summary.

The same principle applies at smaller scales. If a research note is corrected, the old version may matter. If a file is renamed or moved, the links to it must still work and the change should be recoverable. If an interpretation replaces an earlier one, the underlying source should not disappear with the discarded interpretation.

This is why durable knowledge systems need logs as well as libraries.

Memory should have a history

An AI memory system becomes more useful as it accumulates information. That makes the history of the information more important, not less.

The recent memory-poisoning work makes that unusually concrete. If an agent can absorb an untrusted observation, summarize it, and later retrieve the summary after its origin has been obscured, then remembering more is not automatically an improvement. Persistence without source authority can simply make an error harder to see.

A useful memory system should not merely remember the answer. It should preserve enough of the record that you can still ask why the answer is there.

Sources

Relevant Ulix tools

Funes + Ulix Cortex

Funes and Ulix Cortex are sophisticated synthesis tools for collections where provenance matters. Both turn source material into structured knowledge while maintaining a path back to the underlying records.

Funes is the do-it-yourself option: an open-source Librarian framework for building a durable, versioned Markdown knowledge base, with preserved raw sources, source notes, change history, health checks, and room for project-specific tooling.

Ulix Cortex is the handled option. A dedicated handler collects the source material and handles ingestion, processing, archive design, and tooling. The entire archive is customized around the client's work and goals, including its structure and the tools used to produce useful outputs such as book chapter outlines, course designs, speeches, and other source-backed syntheses. Cortex also surfaces concepts, topics, and tensions that recur across the client's work, while preserving the path back to the underlying sources. The client does not have to engineer or operate the archive.