What is Agent Memory?
Agent InternalsThe state an agent carries between steps and between runs: conversation history, retrieved context, prior outcomes. Memory is what makes the loop a loop, and it is also how stale or poisoned context persists into new decisions.
Why It Matters
Without memory an agent is a function: same input, same output, no accumulation. Memory is what makes the loop a loop: each step’s outcome informs the next decision, and each run can be smarter than the last.
Memory is also the persistence layer for problems. Whatever gets written down gets read later, including the wrong things. Stale context, outdated facts, and poisoned entries all survive into future decisions exactly as reliably as the good ones.
The Five Memory Types
Working memory. The current run’s context window: the conversation so far, retrieved documents, tool results. Fast, scoped, and discarded when the run ends.
Episodic memory. Outcomes of prior runs: what was tried, what worked, what failed. The append-only archive that stops an agent repeating a mistake it already made.
Semantic memory. What is known: the project, the stack, the domain. For an agent working a codebase, the repository itself is the semantic store, and it outlives the runs that read it.
Procedural memory. How to behave: rules, workflows, guardrails, and the lessons that survived contact with reality.
Prospective memory. What to watch for: conditions that have not failed yet but might. The type that converts memory from a record into a warning.
Where It Breaks
The first break is staleness: a fact written three months ago is still true to the agent long after it stopped being true in the world. The second is unbounded growth: memory that never expires crowds out the signal with accumulated noise.
The third is memory poisoning: a corrupted entry written once that steers every future run without tripping a single-run check. Because the bad input lands through a legitimate channel, per-run guardrails never see it.
How Flytebit Handles It
Memory in our builds is scoped and auditable: explicit write policies on what may persist, expiry on what should age out, and memory reads captured in the trajectory so a poisoned entry is traceable to when it was written. The attack surface is documented in Agentic AI Horror Stories, and the architecture is in How AI Agents Work.