What is Agent Memory?

Why It Matters

Without memory an agent is a function: same input, same output, no accumulation. Memory is what makes the loop a loop: each step’s outcome informs the next decision, and each run can be smarter than the last.

Memory is also the persistence layer for problems. Whatever gets written down gets read later, including the wrong things. Stale context, outdated facts, and poisoned entries all survive into future decisions exactly as reliably as the good ones.

The Memory Layers

Working context. The current run’s context window: the conversation so far, retrieved documents, tool results. Fast, scoped, and discarded when the run ends.

Episodic memory. Outcomes of prior runs: what was tried, what worked, what failed. This is how an agent avoids repeating a mistake it already made.

Long-term store. Persisted facts, preferences, and learned state across runs. The most valuable layer and the most dangerous one, because it outlives every session and every reviewer.

Where It Breaks

The first break is staleness: a fact written three months ago is still true to the agent long after it stopped being true in the world. The second is unbounded growth: memory that never expires crowds out the signal with accumulated noise.

The third is memory poisoning: a corrupted entry written once that steers every future run without tripping a single-run check. Because the bad input lands through a legitimate channel, per-run guardrails never see it.

How Flytebit Handles It

Memory in our builds is scoped and auditable: explicit write policies on what may persist, expiry on what should age out, and memory reads captured in the trajectory so a poisoned entry is traceable to when it was written. The attack surface is documented in Agentic AI Horror Stories, and the architecture is in How AI Agents Work.