Persistent memory is becoming one of the useful features of AI agents, and one of the more interesting ways for them to fail. A June study of memory poisoning in LLM agents described the basic problem: information encountered through documents, webpages, emails, tool outputs, or user interactions can be written into long-term memory and later retrieved as if it were trusted context. Once stored, it can influence later sessions after the original source has disappeared from view. The study, From Untrusted Input to Trusted Memory, also found that existing prompt-injection defenses do not adequately cover memory poisoning.

A July 31 preprint submitted to EMNLP 2026 describes an even subtler failure: provenance laundering. During memory consolidation, an agent may summarize or rewrite an external observation while losing the fact that it came from an untrusted source. The claim survives while its authority changes. Memory Provenance Laundering in LLM Agents treats preservation of source authority as a security boundary. It is a conference submission and has not yet been through the review process, a status worth keeping visible in a piece about epistemic accountability.

The security problem is also an old archival problem in a new form. An archive is not simply a collection of statements. A serious archive preserves relationships among statements, sources, dates, versions, authors, surrounding records, and the processes by which records entered the collection. Those relationships help determine what the material can legitimately support.

This becomes important whenever information is transformed. A quotation becomes a note, a note becomes a summary, several summaries become a concept, and the concept appears in an answer. Each step can be useful, but if the system retains only the final abstraction it may preserve the conclusion while losing why anyone believed it.

The source trail is part of the knowledge

A trustworthy memory system should be able to answer more than What do we know?

  • Where did this claim come from?
  • What original record supports it?
  • Is this a quotation, an observation, an inference, or a generated summary?
  • What surrounded the statement in the original record?
  • Has the underlying information changed?
  • Who or what changed it?
  • What did the system believe before the change?
  • Did another source disagree?
  • Was the disagreement resolved, or merely hidden by the latest summary?

Provenance therefore cannot be reduced to a citation pasted onto the end of a paragraph. It is the history of a piece of information: its source, transformations, relationships, and sometimes the record of its correction. Provenance does not make information true; a false statement can have impeccable provenance. What it does is make a statement inspectable, so a later reader or agent can discover why the archive contains it and whether the evidence still supports it.

Recent work on persistent agent-memory architecture is converging on surprisingly archival language. A July Internet-Draft on persistent memory in agentic systems proposes typed and versioned memory objects, machine-readable provenance, validation states, immutable logical revisions, and an append-only event ledger. It also separates authoritative persistent state from derived objects such as embeddings, retrieval indexes, caches, and generated summaries. The document is a work in progress, not an IETF standard.

An embedding can help find a source without becoming the source. A generated summary can help explain a document without replacing the document. A conversational answer can be excellent and still remain a derived output.

Context can be part of the information

This becomes especially obvious in social-media archives. A post does not exist only as a string of text. Its timestamp, account, place in a thread, attached image, or relationship to a deleted parent post may change what it can establish. An archive can also look complete while silently reflecting whatever the platform happened to expose to its export or capture tool.

Leisa Gibbons's 2026 paper Mediated recordkeeping and epistemic accountability in social media archiving presses on exactly this problem. Digital records arrive in archives through platforms, capture tools, preservation decisions, and institutional practices. Those mediations shape what survives and therefore what the resulting archive can legitimately be used to establish. Gibbons argues that archives need to document not only what was captured but the platform and archival conditions that shaped the record.

Sometimes the surrounding context is part of the information itself. Strip a statement from its exchange and the words may survive while the meaning shifts. Preserve a screenshot without its date or account identity and the image remains, but its evidentiary value changes.

This is why archival provenance is more demanding than ordinary citation. A citation can tell you where a sentence came from. Provenance can also tell you what kind of record it was, what surrounded it, how it reached the archive, what may be missing, and what happened to it afterward. An AI memory that says only “X happened” is correspondingly weaker than one that can also say who asserted X, when, from which document or interaction, and through which transformations the claim passed before becoming stored context.

Sometimes the archive is part of the evidence

The importance of this becomes obvious when sources disagree. The Apollo 11 research archive keeps original NASA documents, compiled source notes, concept articles, and research outputs separately. One output is a discrepancy ledger, a running register of places where the primary record gives incompatible values for the same fact rather than simply choosing the cleanest number and deleting the mess.

For example, different Apollo 11 records give different distances between the Lunar Module and West Crater. Later Lunar Reconnaissance Orbiter imagery can adjudicate much of that conflict. Other disagreements cannot be settled from the available evidence and remain explicitly unresolved, and that unresolved status is itself useful information.

A system that silently normalizes every conflict may produce cleaner answers while preserving less knowledge. The existence of two incompatible records, their dates, contexts, and later attempts at adjudication can matter as much as whichever number lands in the current summary. The same principle applies to corrected notes, renamed files, and interpretations that supersede earlier ones: the underlying record and the history of change should remain recoverable.

Durable knowledge systems therefore need logs as well as libraries.

Memory should have a history

An AI memory system becomes more useful as it accumulates information, which makes the history of that information more important, not less. If an agent can absorb an untrusted observation, summarize it, and later retrieve the summary after its origin has been obscured, then remembering more is not automatically an improvement. Persistence without source authority can make an error harder to see.

A useful memory system should preserve enough of the record that you can still ask why an answer is there.

Sources

Relevant Ulix tools

Funes + Ulix Cortex

Funes and Ulix Cortex are sophisticated synthesis tools for collections where provenance matters. Both turn source material into structured knowledge while maintaining a path back to the underlying records.

Funes is the do-it-yourself option: an open-source Librarian framework for building a durable, versioned Markdown knowledge base, with preserved raw sources, source notes, change history, health checks, and room for project-specific tooling.

Ulix Cortex is the handled option. A dedicated handler collects the source material and handles ingestion, processing, archive design, and tooling. The entire archive is customized around the client's work and goals, including its structure and the tools used to produce useful outputs such as book chapter outlines, course designs, speeches, and other source-backed syntheses. Cortex also surfaces concepts, topics, and tensions that recur across the client's work, while preserving the path back to the underlying sources. The client does not have to engineer or operate the archive.