Why AI Agents Forget, or Remember the Wrong Thing

An AI agent forgets when its short-term working space fills up or gets cleared, and it remembers the wrong thing when an outdated or planted note is saved to long-term memory and read back as fact. Keep the working space small, store notes with their source and date, check what gets written, and start a fresh session when the agent goes in circles.

This article is for owners and managers putting an AI agent on real work: answering guests, drafting quotes, or following up on orders. It explains the two kinds of memory an agent has, the ways each one fails, and the checks that keep both honest.

What does an AI agent actually remember?

An agent has two layers of memory, and they fail in different ways.

The first is its working space, called the context window: everything the model can see at the moment it answers. Think of it as the desk in front of a staff member. It holds the instructions, the conversation so far, and the results of every lookup the agent made, such as a booking search or a price check. When the session ends, the desk is cleared.

The second is persistent memory: notes the agent writes somewhere that survives the session. That can be a plain text file (some agent tools keep a MEMORY.md), a regular database, or a vector database, which finds notes by meaning rather than exact words. Think of it as the notebook the staff member takes home and reads again tomorrow.

Almost every "the AI forgot" or "the AI made that up" complaint traces back to one of those two rows. The fix depends on which one.

Why does a long session make the agent worse?

A bigger desk does not make a better worker if the desk is buried in paper. Language models behave the same way.

Chroma, a vector database company, tested 18 models in a study published on 14 July 2025 and found that accuracy dropped as the input got longer, even on simple tasks. On a memory benchmark called LongMemEval, the same models scored significantly higher when given a focused prompt of about 300 tokens than when given the full history of about 113,000 tokens. A token is the unit a model reads and bills by, roughly three-quarters of an English word. The relevant facts were present in both versions; the extra material simply got in the way. The researchers call this effect "context rot".

The practical lesson: pasting the whole SOP, every past chat, and every lookup result into the agent's context does not make it smarter. It makes the important line harder to find. Deciding what goes on the desk for each step is now called context engineering, and it matters more than the size of the window the vendor advertises.

How do you keep the working space lean?

Clear what is no longer needed, and fetch what is needed only when it is needed.

Old lookup results are the biggest source of clutter. A booking agent that searched availability twenty times in one session is carrying nineteen answers it no longer needs. Anthropic added a feature that removes these old results automatically as the window fills up. In its announcement of 29 September 2025, the company reported that combining this with a file-based memory tool improved results by 39% on its internal agent search evaluation, and that the clean-up alone cut token use by 84% over a 100-turn task. Those are the vendor's own tests, not a promise for your workload, but the direction is consistent with the Chroma findings.

Four habits work whichever AI provider you use:

• Pass only the fields the step needs. An agent confirming a booking needs the guest name, dates, room type, and status, not the whole guest profile.
• Look things up instead of preloading them. Search the price list or the policy document at the moment of the question, as in retrieval for business data, rather than pasting every document in at the start.
• Summarise, then restart. When a session runs long, have the agent write a short handover note, then continue in a new session that starts from that note.
• Put rules at the start and the current task at the end. Instructions buried in the middle of a long session are the ones most often ignored.

When does saved memory become wrong?

Saved memory goes wrong in three ways, and only one of them involves an attacker.

It goes stale. A note says "deluxe room: Rp850,000" or "Andi handles refunds". Both were true when written. Next month the rate changes and Andi moves to another branch, but the note stays, and the agent keeps quoting it with full confidence.

It contradicts itself. The agent saves "customer prefers email" in March and "customer asked for WhatsApp only" in June. Without dates, it has no way to know which one wins, so it picks one at random from one session to the next.

It gets poisoned. An outsider tricks the agent into writing a false note. A paper posted to arXiv on 6 July 2026 describes an attack called MemGhost: a single crafted email to an inbox the agent reads gets the agent to record attacker-chosen falsehoods in its own memory file. The note stays after the email is deleted and shapes later, unrelated answers. On the researchers' benchmark, the attack succeeded end to end 87.5% of the time against OpenClaw running GPT-5.4 and 71.4% against an agent built on the Claude Code SDK with Sonnet 4.6. The Cloud Security Alliance's note of 23 July 2026 cautions that sample sizes per condition are small, so read the numbers as a clear pattern rather than a precise rate. It is the same weakness covered in prompt injection for inbox agents, except the damage outlives the conversation.

What should a memory entry look like?

A useful memory entry records where the fact came from and when it stops being trustworthy, not just the fact itself.

Then apply one rule before anything is saved: if the fact already lives in a system of record, such as the hotel's reservation system, the price list, or the staff roster, do not copy it into memory. Save a pointer to where it lives and look it up fresh each time. Memory is for things no other system holds, such as a guest's stated preference or a decision a manager made in chat.

The approval step adds friction, and that friction is the point. Text the agent read in an email or on a website should never become a trusted fact without a person looking at it. Log every memory change with what triggered it, so a bad note can be traced and removed.

When should you reset the agent?

Reset the working space when the session goes wrong. Audit the long-term memory on a schedule.

Signs a session needs a fresh start:

• It repeats the same failed step two or three times.
• It follows an older instruction after you gave a newer one.
• It quotes a figure that has since changed.
• It drags in details from a different customer or task.

A reset means a new session that starts from a short handover note, not from the full transcript. For long-term memory, review the entries once a month or whenever prices, staff, or policies change, delete what has expired, and keep a dated backup so you can roll back to a known-good copy if a poisoned note slips through.

Turn each memory failure into a test. If the agent once quoted last month's rate, add a test case where the rate has changed and check that it looks the price up instead of recalling it. The method is in evals for AI features.

What should you ask before an agent gets memory?

Five questions settle most of the risk before an agent with memory goes live:

If a vendor or internal team cannot answer these, the agent's memory is a liability rather than a feature. If you are planning an agent for bookings, customer messages, or internal records and want the memory design reviewed before it goes live, that is the kind of work covered under system architecture consulting.