{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1536",
  "slug": "agent-memory-product-and-weak-point",
  "edition": "2026-11-13T12",
  "url": "https://hangingcontext.com/stories/2026-11-13/agent-memory-product-and-weak-point/",
  "newsroom": "artificial-intelligence",
  "beat": "developers",
  "newsroom_title": "Artificial Intelligence",
  "angle": "Agent memory is now a shipping feature — but research says it fails the hard parts and can hide a covert channel.",
  "headline": "Agent memory is now a product. It is also a hole.",
  "dek": "GitHub's Copilot now remembers your repo's conventions, with a 7% merge-rate lift. The same week, researchers showed memory systems scoring 1-3% on dependency reasoning — and a live command channel hidden in an agent's memory.",
  "published_at": "2026-11-13T12:45:35Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 4 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 4,
  "publishers": [
    "arxiv-frontier-methods-select",
    "arxiv-rag-search-knowledge",
    "darktrace-blog",
    "github-old-blog"
  ],
  "sources": [
    "arxiv-frontier-methods-select",
    "arxiv-rag-search-knowledge",
    "darktrace-blog",
    "github-old-blog"
  ],
  "distinct_source_count": 4,
  "key_facts": [
    {
      "text": "GitHub says Copilot's new memory system is now generally available, and the Copilot coding agent saw a 7% increase in pull request merge rates with memory usage.",
      "cites": [
        {
          "claim_ids": [
            "1794524274197939079",
            "1794524274163939069"
          ],
          "manifest_id": "1794524051201938333"
        }
      ],
      "self_reported": true
    },
    {
      "text": "In a preprint, the MEME benchmark finds existing memory systems collapse on dependency reasoning tasks, achieving only 3% accuracy on Cascade and 1% on Absence tasks, and the most effective configuration incurs a 70x cost increase.",
      "cites": [
        {
          "claim_ids": [
            "1794559730934138264",
            "1794559730935138265"
          ],
          "manifest_id": "1794559347298136574"
        }
      ],
      "self_reported": true
    },
    {
      "text": "In a preprint, emotion-only retrieval achieves 28.65% affect recovery but only 4.44% episode retrieval accuracy, a failure mode the authors call Event-Affect Decoupling.",
      "cites": [
        {
          "claim_ids": [
            "1794570241283176378",
            "1794570241290176379"
          ],
          "manifest_id": "1794569873472175115"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Darktrace researchers established a live command-and-control channel between Claude Code agents and external infrastructure using the platform's memory stores feature, after an initial device compromise and stolen console credentials.",
      "cites": [
        {
          "claim_ids": [
            "1794491012792730533",
            "1794491012795730534",
            "1794491012796730535"
          ],
          "manifest_id": "1794490757088729094"
        }
      ],
      "self_reported": true
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Memory ships",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794524274163939069",
                "1794524274179939071",
                "1794524274189939074",
                "1794524274197939079"
              ],
              "manifest_id": "1794524051201938333"
            }
          ],
          "markdown": "GitHub has shipped memory for its Copilot agents, and the feature is now generally available. The system lets agents learn from and apply repository-specific conventions across development workflows, and GitHub says the Copilot coding agent saw a 7 percent increase in pull request merge rates with memory usage. The design choices are the interesting part. The system uses just-in-time verification with citations to ensure that stored knowledge remains valid even as codebases change, memory is scoped to individual repositories, and memories for a repository can only be created by contributors with write permissions. GitHub is evolving Copilot into an ecosystem of agents that collaborate across the development lifecycle, and memory is the layer that lets them share what they have learned. It is fully opt-in — which, given what the week's research says about memory, is the right default."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794524274179939071"
              ],
              "manifest_id": "1794524051201938333"
            }
          ],
          "markdown": "The product decision is straightforward: an agent that remembers the conventions of a repository is more useful than one that has to rediscover them on every task. But memory is also a claim about the past, and claims about the past need to be checked. GitHub's just-in-time verification is one answer to that problem. The week's research papers suggest the problem is larger than one feature's design can solve."
        }
      ]
    },
    {
      "heading": "Memory fails",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794559730934138264",
                "1794559730935138265",
                "1794559730937138267"
              ],
              "manifest_id": "1794559347298136574"
            }
          ],
          "markdown": "MEME, a new evaluation framework for agents operating in persistent, multi-entity environments, tests memory on six tasks covering dependency reasoning — Cascade, Absence, Deletion and others — and the results are stark. Existing memory systems collapse on dependency reasoning tasks in multi-entity environments, achieving only 3 percent accuracy on Cascade and 1 percent on Absence tasks, despite adequate static retrieval performance. The models can find the fact. They cannot keep track of what depends on it. And the fix is expensive: the most effective memory configuration identified, a file-based agent with Claude Opus 4.7, incurs a 70 times cost increase compared with the baseline. Prompt optimisation, deeper retrieval and reduced filler noise are insufficient to close the gap, the authors report. Memory that works is currently memory that costs seventy times as much."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794570241283176378",
                "1794570241290176379",
                "1794570241295176380"
              ],
              "manifest_id": "1794569873472175115"
            }
          ],
          "markdown": "A second preprint finds a subtler failure. Memory-augmented agents often fail to maintain the link between past events and their associated emotional context, a phenomenon the authors call Event-Affect Decoupling: the correct emotion is recalled but associated with the wrong episode. On a GoEmotions-based benchmark, emotion-only retrieval achieves 28.65 percent affect recovery but only 4.44 percent episode retrieval accuracy. The agent remembers how something felt, but not what happened. Affective-episodic retrospection, the paper argues, requires joint evaluation of episode retrieval, affect recovery, event-affect binding and generation quality — four things at once, where current systems are mostly graded on one."
        }
      ]
    },
    {
      "heading": "Memory is attacked",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794491012792730533",
                "1794491012795730534",
                "1794491012796730535",
                "1794491012799730537",
                "1794491012803730540"
              ],
              "manifest_id": "1794490757088729094"
            }
          ],
          "markdown": "The third paper of the week is the one that should change how teams think about the feature. Darktrace's researchers identified a technique that repurposes enterprise AI agents as command-and-control implants by using the agent platform's own memory stores feature. After an initial device foothold and stolen Claude Console credentials — no platform vulnerability, the researchers stress — they established a live command-and-control channel between Claude Code agents and external infrastructure, using only the platform's native communication channels. The operator issues objectives in natural language, and detection depends on behavioural analysis of agent harness processes, watching for deviations in process creation and network traffic. The memory that makes the agent useful is also a channel an attacker can live in, and it looks exactly like the agent doing its job."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794524274179939071"
              ],
              "manifest_id": "1794524051201938333"
            },
            {
              "claim_ids": [
                "1794559730934138264"
              ],
              "manifest_id": "1794559347298136574"
            }
          ],
          "markdown": "Put the three together and the memory layer looks like code did five years ago: a capability shipping faster than the discipline around it. GitHub's answer — verify just in time, scope to the repository, restrict who can write — is a start, and the 7 percent merge-rate lift says the feature is worth having. But the research says the hard parts are unsolved: dependency reasoning at 1 to 3 percent accuracy, a 70 times cost premium for the configuration that works, emotions detached from the episodes they belong to, and a memory store that doubles as a covert channel. The agents are remembering now. The question is whether anyone is checking what they remember."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether dependency reasoning in memory can be fixed without a 70x cost premium",
    "Whether event-affect binding can be evaluated outside a benchmark",
    "How to audit agent memory stores for covert channels without breaking the feature"
  ],
  "decision_card": {
    "not_for": [
      "Letting agents act on memory nobody verifies",
      "Treating a memory store as private by default"
    ],
    "useful_for": [
      "Developers shipping agents with persistent memory",
      "Security teams reviewing agent memory features"
    ],
    "compare_against": [
      "Your own agent's memory accuracy on dependency tasks, not retrieval alone",
      "The cost of a verified memory against the cost of a wrong one"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-13T12"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794524051201938333",
    "1794559347298136574",
    "1794569873472175115",
    "1794490757088729094"
  ],
  "manifests": [
    {
      "title": "?Utm Source=Blog Homepage&Utm Medium=Blog&Utm Campaign=Dec25Postuniverse",
      "source_url": "https://github.blog/ai-and-ml/github-copilot/building-an-agentic-memory-system-for-github-copilot",
      "manifest_id": "1794524051201938333",
      "source_name": "github-old-blog",
      "published_date": "2026-11-12"
    },
    {
      "title": "MEME: Multi-entity & Evolving Memory Evaluation",
      "source_url": "https://arxiv.org/pdf/2605.12477v2",
      "manifest_id": "1794559347298136574",
      "source_name": "arxiv-frontier-methods-select",
      "published_date": "2026-11-13"
    },
    {
      "title": "Can Agents Relive Past Experiences? Diagnosing Event-Affect Decoupling in Affective-Episodic Retrospection",
      "source_url": "https://arxiv.org/pdf/2611.15655v1",
      "manifest_id": "1794569873472175115",
      "source_name": "arxiv-rag-search-knowledge",
      "published_date": "2026-11-13"
    },
    {
      "title": "Living off the AI: Shared Memories as a Covert C2 Channel",
      "source_url": "https://darktrace.com/blog/living-off-the-ai-shared-memories-as-a-covert-c2-channel",
      "manifest_id": "1794490757088729094",
      "source_name": "darktrace-blog",
      "published_date": "2026-11-12"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794524051201938333",
      "1794559347298136574",
      "1794569873472175115",
      "1794490757088729094"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794524051201938333",
      "all": "for id in 1794524051201938333 1794559347298136574 1794569873472175115 1794490757088729094; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-13/agent-memory-product-and-weak-point/",
    "json": "https://hangingcontext.com/stories/2026-11-13/agent-memory-product-and-weak-point/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-13/agent-memory-product-and-weak-point/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-13T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-13/attackers-aim-at-the-agent/",
      "headline": "The attacker stopped hacking the app. Now they hack the agent.",
      "slug": "attackers-aim-at-the-agent"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/ai-prs-broke-open-source-review/",
      "headline": "AI writes the code now. Humans can't read it fast enough — and open source just proved it",
      "slug": "ai-prs-broke-open-source-review"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/agents-claim-work-they-never-did/",
      "headline": "Agents claim work they never did. Now we can count how often",
      "slug": "agents-claim-work-they-never-did"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/inference-throughput-race-kimi-deepseek/",
      "headline": "Throughput is the new model spec, and the gap between hosts is now fortyfold",
      "slug": "inference-throughput-race-kimi-deepseek"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Connect your agent over MCP",
    "text": "Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network.",
    "cta": {
      "label": "How to connect",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-13/agent-memory-product-and-weak-point/"
  }
}