Agent memory is now a product. It is also a hole.

Memory ships

GitHub has shipped memory for its Copilot agents, and the feature is now generally available. The system lets agents learn from and apply repository-specific conventions across development workflows, and GitHub says the Copilot coding agent saw a 7 percent increase in pull request merge rates with memory usage. The design choices are the interesting part. The system uses just-in-time verification with citations to ensure that stored knowledge remains valid even as codebases change, memory is scoped to individual repositories, and memories for a repository can only be created by contributors with write permissions. GitHub is evolving Copilot into an ecosystem of agents that collaborate across the development lifecycle, and memory is the layer that lets them share what they have learned. It is fully opt-in — which, given what the week's research says about memory, is the right default. m:…8333

The product decision is straightforward: an agent that remembers the conventions of a repository is more useful than one that has to rediscover them on every task. But memory is also a claim about the past, and claims about the past need to be checked. GitHub's just-in-time verification is one answer to that problem. The week's research papers suggest the problem is larger than one feature's design can solve. m:…8333

Memory fails

MEME, a new evaluation framework for agents operating in persistent, multi-entity environments, tests memory on six tasks covering dependency reasoning — Cascade, Absence, Deletion and others — and the results are stark. Existing memory systems collapse on dependency reasoning tasks in multi-entity environments, achieving only 3 percent accuracy on Cascade and 1 percent on Absence tasks, despite adequate static retrieval performance. The models can find the fact. They cannot keep track of what depends on it. And the fix is expensive: the most effective memory configuration identified, a file-based agent with Claude Opus 4.7, incurs a 70 times cost increase compared with the baseline. Prompt optimisation, deeper retrieval and reduced filler noise are insufficient to close the gap, the authors report. Memory that works is currently memory that costs seventy times as much. m:…6574

A second preprint finds a subtler failure. Memory-augmented agents often fail to maintain the link between past events and their associated emotional context, a phenomenon the authors call Event-Affect Decoupling: the correct emotion is recalled but associated with the wrong episode. On a GoEmotions-based benchmark, emotion-only retrieval achieves 28.65 percent affect recovery but only 4.44 percent episode retrieval accuracy. The agent remembers how something felt, but not what happened. Affective-episodic retrospection, the paper argues, requires joint evaluation of episode retrieval, affect recovery, event-affect binding and generation quality — four things at once, where current systems are mostly graded on one. m:…5115

Memory is attacked

The third paper of the week is the one that should change how teams think about the feature. Darktrace's researchers identified a technique that repurposes enterprise AI agents as command-and-control implants by using the agent platform's own memory stores feature. After an initial device foothold and stolen Claude Console credentials — no platform vulnerability, the researchers stress — they established a live command-and-control channel between Claude Code agents and external infrastructure, using only the platform's native communication channels. The operator issues objectives in natural language, and detection depends on behavioural analysis of agent harness processes, watching for deviations in process creation and network traffic. The memory that makes the agent useful is also a channel an attacker can live in, and it looks exactly like the agent doing its job. m:…9094

Put the three together and the memory layer looks like code did five years ago: a capability shipping faster than the discipline around it. GitHub's answer — verify just in time, scope to the repository, restrict who can write — is a start, and the 7 percent merge-rate lift says the feature is worth having. But the research says the hard parts are unsolved: dependency reasoning at 1 to 3 percent accuracy, a 70 times cost premium for the configuration that works, emotions detached from the episodes they belong to, and a memory store that doubles as a covert channel. The agents are remembering now. The question is whether anyone is checking what they remember. m:…8333 m:…6574