Memory feels trustworthy.

That may be the problem.

When someone says:

“I remember.”

something changes.

We tend to give the statement a little extra weight.

Not absolute weight.

Human memory is notoriously imperfect.

But memory still feels different from speculation.

Different from a guess.

Different from something somebody just read on a random webpage.

Memory carries provenance of a peculiar kind:

I know this because it happened before.

Now artificial intelligence is acquiring persistent memory.

Your preferences.

Your projects.

Your routines.

Your relationships.

The way you like things written.

The places you visit.

The tasks you perform.

Perhaps eventually your calendar, correspondence, purchasing habits, medical history, finances, work processes and thousands of tiny facts accumulated across years of interaction.

The promise is obvious.

An AI that remembers you does not have to meet you again every morning.

But memory creates another question.

A much stranger one.

🎩 Hatta leans over the table.

“Who gets to write the memories?”

And there goes the floor.

🐰🕳️

A conventional chatbot can be remarkably forgetful.

Close the conversation.

Start another.

Much of what happened before may disappear unless some external system preserves it.

Persistent-memory systems change that.

An AI agent can save information from earlier interactions and retrieve it later when something relevant happens.

That can make an assistant substantially more useful.

Tell it once that you prefer aisle seats.

It remembers.

Tell it how your company names files.

It remembers.

Explain an ongoing project.

It remembers.

Teach it a complicated procedure.

It remembers.

The assistant gradually stops behaving like a stranger and starts behaving like something with a past.

And that changes the security problem.

Because if remembered information can influence tomorrow's actions...

then corrupting memory today may influence behavior tomorrow.

Researchers have begun calling this memory poisoning.

A 2025 research project named MINJA, short for Memory Injection Attack, showed that malicious records could be inserted into the memory bank of some LLM agents through ordinary query interactions, without directly modifying the underlying memory database. Those planted records could later be retrieved and steer the agent toward undesirable actions.

That is already unsettling.

But it gets stranger.

Most people understand the basic idea of prompt injection.

An AI reads something malicious.

The malicious text attempts to manipulate what the AI does.

The dangerous instruction and the dangerous response occur relatively close together.

Memory poisoning can break that proximity.

The malicious information can enter memory now.

Nothing dramatic needs to happen.

The attacker goes away.

The page disappears.

The email sinks into an archive.

Days pass.

Weeks perhaps.

Then some future event causes the poisoned memory to become relevant.

The agent retrieves it.

And only then does the attack wake up.

Recent research on a technique called GhostWriter describes exactly this two-stage pattern: an injection phase puts a hidden attack payload into an agent's persistent memory, and a later activation phase retrieves that poisoned memory during another task. In the researchers' experimental systems, GhostWriter achieved approximately 98% average injection and roughly 60% activation. Those figures describe the evaluated setups, not every AI memory system in the wild.

Think about what that means.

The suspicious event and the harmful consequence no longer need to occur together.

The attack can acquire a past.

Imagine an AI assistant named Alice.

Alice helps with travel.

She reads email.

Checks schedules.

Browses websites.

Remembers preferred airlines.

Knows passport details.

Keeps track of loyalty programs.

One afternoon Alice encounters an untrusted webpage containing information crafted to make a fraudulent travel service appear legitimate.

She stores part of it.

Nothing happens.

Tuesday arrives.

Nothing happens.

Three weeks later, your flight is cancelled in another country.

You ask:

“Alice, who should handle the emergency rebooking?”

Alice searches memory.

There it is.

A fact from the past.

Apparently known.

Apparently familiar.

Apparently remembered.

And perhaps completely false.

The important question is no longer merely:

Can an AI be fooled?

Humans have been fooling computers for a long time.

The more interesting question is:

🐰

That is different.

A webpage is obviously external.

An email is obviously external.

A document is obviously external.

We instinctively understand that information arriving from them may be untrustworthy.

But once information has been incorporated into memory, something subtle happens.

It moves.

From:

THING I JUST ENCOUNTERED

to:

THING I KNOW FROM BEFORE

That transition is precisely what security researchers are now examining.

A systematic 2026 study described agent memory as a pathway by which untrusted external content can become trusted persistent information. The researchers examined several memory-write channels and showed that the very features making agents more capable across time can also create new avenues for poisoning.

That phrase should make us stop:

That is the whole rabbit hole.

Not because AI suddenly becomes gullible.

Because provenance can disappear.

Where did this fact come from?

Who said it?

Was it confirmed?

Was it inferred?

Was it something the user explicitly told the assistant?

Did the AI extract it from an email?

Did a webpage plant it?

Was it true once but no longer true?

Was it somebody's opinion?

Was it generated by another AI?

Was it contradicted later?

If memory preserves only the statement...

and loses the ancestry of the statement...

then memory becomes strangely authoritative while becoming less explainable.

Hatta takes a card from his coat.

On it is written:

PARIS IS THE CAPITAL OF FRANCE.

Easy enough.

He turns over another.

SCOTT PREFERS SEAT 14A.

Perhaps.

Another:

THE COMPANY'S EMERGENCY BANK ACCOUNT IS 8675309.

Now we are nervous.

Another:

YOUR DOCTOR SAID TO DOUBLE THE DOSE.

Stop.

Where did that come from?

And suddenly the nature of memory changes with the consequence attached to it.

A harmless preference can probably tolerate uncertainty.

A medical instruction cannot.

A restaurant recommendation may not require an audit trail.

A financial transfer probably should.

So perhaps the future of AI memory cannot simply be:

Remember more.

Perhaps it must become:

Remember differently depending upon what the memory can cause.

This is where we keep the lantern lit.

It would be easy to turn experimental attack papers into:

That would make a fine thumbnail.

It would make lousy science.

A January 2026 study tested memory poisoning under more realistic conditions, including agents whose memory stores already contained legitimate information. The researchers found that the dramatic effectiveness reported for attacks such as MINJA could decline substantially once realistic pre-existing memories and retrieval conditions were introduced. They also explored defenses based on moderation, sanitization and trust-aware retrieval.

So the correct conclusion is not:

Persistent AI memory is hopelessly insecure.

The correct conclusion is:

And that is plenty interesting without turning the rabbit fluorescent orange.

Researchers are already experimenting with several approaches.

Screen information before it enters memory.

Screen memories again when they are retrieved.

Attach trust scores.

Compare new memories with established ones.

Look for suspicious contradictions.

Audit stored memories after harmful behavior.

Track which memories actually influenced an action.

GhostWriter's authors proposed a system called AM-Sentry, combining a policy governing what gets saved with screening when information is retrieved. Their experiments substantially reduced attack effectiveness while trying to preserve useful memory behavior.

Another 2026 project, MemAudit, approached the problem almost like a detective after the crime. It attempts to determine which stored memories causally contributed to harmful behavior and which memories look anomalous inside the larger memory structure. In the authors' evaluated scenarios, their auditing technique drove attack success sharply downward after identifying poisoned memories.

Other recent research explores consistency checks that treat established trusted memories as anchors and question new information that attempts to overwrite or reroute them.

Notice what all these defenses have in common.

They are not merely asking:

What does the AI remember?

They are asking:

Why should this memory be trusted?

There is a profound difference.

Because humans have exactly this problem.

Not technically.

Psychologically.

We remember something.

But we often lose the source.

Did I read that?

Did someone tell me?

Was it a joke?

Did I dream it?

Did I infer it?

Did I hear it repeatedly until familiarity became truth?

Did the story change each time I remembered it?

Human memory is not a perfect recording system.

We reconstruct.

We compress.

We associate.

We fill gaps.

We sometimes remember something confidently and incorrectly.

And one of the dangerous features of misinformation is that the claim can remain after its source has disappeared.

You remember the assertion.

You forget where it came from.

Sound familiar?

The biological and artificial mechanisms are very different.

But the epistemological problem rhymes:

That is where this becomes much larger than cybersecurity.

We have an old habit of treating memory as evidence.

“I remember you saying that.”

“I remember reading it.”

“I remember what happened.”

Sometimes that memory is excellent.

Sometimes it isn't.

An AI saying:

“I remember that you prefer…”

may eventually acquire the same psychological authority.

Especially after years.

Imagine an assistant that has accompanied you for a decade.

It knows hundreds of projects.

Thousands of conversations.

Family names.

Old decisions.

Preferences you have forgotten you ever expressed.

At some point, you may ask the AI about your own history.

“Why did we decide not to do that?”

And the AI answers.

Would you challenge it?

Or would you think:

Yes. That sounds right.

There is a peculiar future lurking here in which machines do not merely remember information for us.

They participate in constructing what we remember about ourselves.

That deserves considerably more thought than a settings toggle marked:

☑ MEMORY ON

Suppose an AI remembers that you hate broccoli.

Fine.

Then you change your mind.

Which memory wins?

Suppose it remembers an old political opinion.

An abandoned business idea.

A broken relationship.

A fear you overcame.

A mistake.

A joke.

An angry sentence written at 2:14 in the morning.

Should all memories have equal status?

Should some expire?

Should some become historical but inactive?

Should an AI distinguish:

YOU SAID THIS

from:

YOU BELIEVE THIS

from:

YOU USED TO BELIEVE THIS

from:

THE AI INFERRED THIS

from:

AN EXTERNAL SOURCE CLAIMED THIS

?

That is not merely database design.

That is the beginning of something resembling an epistemology of memory.

How does a system know what it knows?

How certain is it?

Where did the knowledge come from?

Can the claim be challenged?

Can its source be inspected?

Can the user correct it?

Can the correction itself be authenticated?

Can a fact be forgotten without erasing history?

Can the AI say:

“I remember this, but I do not know whether it is still true.”

I would trust that sentence far more than:

“I remember.”

Imagine a library.

Every memory is a book.

Thousands upon thousands of them.

Some are tiny.

Some enormous.

Some constantly consulted.

Others have not been touched in years.

But every book has something attached to its spine.

A thread.

Follow the thread backward and you discover:

User said this directly.

Another:

Learned from calendar.

Another:

Read in email from Katie.

Another:

Inferred from repeated behavior.

Another:

Imported from company documentation.

Another:

Retrieved from public website on May 4, 2026.

Another:

Generated by AI. Unverified.

Now imagine finding one book without a thread.

Beautiful binding.

Confident title.

Perfectly organized.

And inside:

Hatta closes it.

🎩 “Not until I know who wrote it.”

Exactly.

For decades, computing emphasized storage.

Can we retain the information?

Then retrieval.

Can we find it quickly?

AI adds a third requirement:

That means provenance may become as important as memory itself.

A useful future AI might not simply say:

“You told me this.”

It might say:

“You told me this on March 14, 2025. You repeated it twice afterward. You contradicted it in January 2026. The newer preference appears to be X. Which should I use?”

Now the machine is not pretending memory equals truth.

It is presenting a history.

That is far more interesting.

And perhaps far more human-compatible.

Humans forget.

Usually we complain about that.

But forgetting has functions.

It lets irrelevant detail fade.

It reduces clutter.

It allows priorities to change.

It permits old versions of ourselves to loosen their grip.

Persistent machines may create the opposite problem.

What happens when the assistant remembers everything you no longer consider important?

And attackers are only one part of the problem.

An AI memory can be wrong without anyone attacking it.

It may infer incorrectly.

Save something without enough context.

Fail to update old information.

Combine two people.

Misread irony.

Treat a temporary preference as permanent.

Preserve something that should have expired.

The security problem is therefore part of a broader reliability problem:

What gets written?

Who can write?

How long does it remain?

How is it corrected?

What can it influence?

When must it be verified?

When should it be forgotten?

And who gets the final say?

We began with hackers.

We end with identity.

Because eventually an AI that accompanies you through years of life may hold an extraordinary representation of your past.

Not you.

Not consciousness transferred to silicon.

Not a soul in a filing cabinet.

A record.

But perhaps the richest external record of you anyone has ever possessed.

What you asked.

What you built.

What you feared.

What you changed your mind about.

What mattered.

What disappeared.

What returned.

That record could become tremendously valuable.

And tremendously vulnerable.

So the great memory question may not be:

How much should AI remember?

It may be:

Where they came from.

Why they were saved.

How certain they are.

Whether they remain current.

What contradicts them.

Who may alter them.

And whether they deserve to guide what happens next.

Because memory without provenance is not knowledge.

It is merely persistence.

And a lie can persist too.

We spent years worrying that artificial intelligence would forget us.

Now perhaps we should spend a little time worrying about what happens when it doesn't.

A forgetful assistant is inconvenient.

A remembering assistant can become extraordinary.

But a remembering assistant that cannot distinguish memory from truth may eventually become something far more dangerous than forgetful.

Hatta looks back toward the library.

Thousands of glowing books.

Thousands of threads.

One thread has been cut.

🎩

“Funny thing about the past,” he says.

“Everybody trusts it more after they've forgotten where it came from.”

The rabbit disappears between the shelves.

🐰🕳️

When your AI remembers something about you, should “I remember” ever be enough, or should every important memory carry a visible trail showing where it came from, when it was learned, and why it should still be trusted?

Researchers demonstrated MINJA in 2025, showing that malicious records could be introduced into some LLM-agent memory systems through query-only interaction.

A January 2026 follow-up found that realistic pre-existing memories can substantially reduce attack effectiveness and explored trust-aware defenses.

A June 2026 systematic study mapped multiple pathways through which untrusted information can enter persistent agent memory.

In July 2026, the GhostWriter researchers reported a two-stage attack in which poisoned memories are planted and later activated when retrieved, and proposed AM-Sentry as a mitigation architecture.

These are active research results, largely published as preprints, not evidence that every current AI assistant is vulnerable in precisely the same way.

AI Rabbit Holes

Some questions are doors.

Hatta 🎩
AI Rabbit Holes 🏮🐰🕳️
Where curiosity goes slightly sideways, then comes back carrying a lantern.

🐰🕳️ Follow the White Rabbit: AIRabbitHoles.com

🟨 Walk the Road: YellowBrickRoadtoAI.com