An AI agent’s memory: what it has to forget

By choosing what it forgets. This is the part of the subject nobody covers in a demo, and it is the part that decides answer quality six months later: an agent memory that swells without a filter makes the agent worse, never better.

The figure that makes this hard to wave away comes from work published in April 2026 on reasoning tasks. The agent whose memory accumulated everything ended with 2,400 records and 13 % correct answers; the same agent, with its memory kept short, held 248 and rose to 39 %. Three times better while keeping ten times less, and the same gap shows up on an autonomous driving set, 51 % against 32 %.

Why remembering more produces worse results

Because an agent does not consult its memory the way you consult a file: it receives a handful of fragments, picked by an approximate search, and reasons over them as though they were true. The bigger the store, the higher the odds that one of those fragments is stale, badly contextualised or simply off topic.

There is a second effect, less obvious, which explains part of the gap. A model reproduces the style and the standard of whatever it rereads: a memory filled with sloppy notes produces sloppy answers, whatever the quality of the model. That is why a quality gate on writing, meaning a filter that refuses to record anything not precise enough to be reused, is worth ten absolute points of accuracy on its own in the same study.

Specialist memory vendors measure it from their side, and the finding converges. On a one-million-word evaluation set, a recent memory engine scores 64.1; on the same set scaled to ten million, it drops to 48.6. Volume alone is enough to lose a quarter of the performance, without a single component failing.

The four ways an agent’s memory decays

The first is the memory torn from its context. “The client turned this profile down” is an unusable sentence six months later: nobody knows which client, which profile, or whether the reason was the person or that month’s budget. It will be retrieved all the same, reread, and taken at face value.

The second is the stale fact, and it is by far the most common. The world moves, the memory does not: a consultant has changed assignments, a company has merged, a preference has been revised. An agent that has been running for eighteen months will act on 2024 facts in 2026 without ever flagging that it is doing so, and that is exactly the mechanism that makes an ageing contact database more dangerous than an empty one.

The third is contamination between two accounts. What was learned at one client surfaces while you are working for another, because the search judged the two situations close. In a staffing firm that boundary is not an architectural convenience, it is a contractual commitment, and an agent that crosses it once costs more than everything it has earned.

The fourth is the error that copies itself. A false fact recorded once is reread, summarised, recorded again in another form, and ends up existing in three mutually consistent copies. At that point its apparent consistency makes it more credible than an isolated correct fact, and nobody traces it back to the source.

Why nobody notices for months

It is a silent failure in the strict sense: nothing is raised as an error, no log fills up, no alert fires. The agent keeps answering, it simply answers slightly worse each week, and the drift is too slow for a user to date.

The symptom, once you know to look for it, is recognisable. Answers become more general, less anchored in the specific case, closer to what a model would say without knowing your company. The agent regresses towards its mean, in other words, and it does so at the exact moment you stopped watching because it was doing well.

That gap between the moment trust settles and the moment quality starts to fall is what makes the subject vicious. You stopped reviewing after six weeks because everything was fine, and it is around the fourth month that the memory begins to weigh.

What we chose to keep, and what we refuse

We built Balt’s memory around one constraint: three categories, and nothing else. This is not a limitation we intend to lift, it is the mechanism that stops the store from swelling.

The first category holds the company’s documents: its rules, its procedures, what it has decided once and for all. They are written by a person, versioned, and visible from any conversation, because a rule that holds at one client holds at all of them.

The second holds one person’s memory, kept apart from everything else. What a recruiter has explained to the agent about the way they work belongs to them, does not surface in a colleague’s conversation, and is erased on request. We refused to melt it into a team memory that would have been simpler to build and more convenient to demonstrate.

The third holds the state of open accounts, which is perishable by nature and therefore expires instead of accumulating. A closed search, a filled assignment, a finished exchange: these leave working memory and become history again, available on request, never reread unprompted.

What we refused deserves saying just as plainly. We do not automatically record what is said in a conversation, because a memory fed without a filter is precisely the case that falls to 13 %. A memory is written when someone asks for it, or when the agent offers to keep it and a person agrees, which is slower at the start and far cheaper in the sixth month. It is the same logic as skills, where an auto-generated addition degrades the whole set.

What to ask a vendor before buying

Four questions are enough to separate a product that has thought about the subject from a product that wired up a vector database and hoped it would hold.

Can I read everything the agent has kept about me and about my company? If the answer is no, or if it involves a support ticket, the memory is not correctable and the rest of the conversation is theoretical.

Can I erase one specific memory, and does that actually erase it? Many implementations mark the memory as deleted without removing it from the search index, which amounts to keeping it.

What expires, and after how long? A vendor with no answer to this question has no forgetting policy, therefore has a memory that grows indefinitely, therefore has the problem described above without knowing it.

What happens between two clients? The right answer is that the partition is structural and verifiable, not that it is “handled by the prompt”. An instruction written in natural language is worked around with another sentence in natural language, as with any limit you think you have set by asking politely.

What this says about the period ahead

Memory is becoming the real ground for differentiation between agents, and that is a recent reversal. For three years the question put to a vendor was about the underlying model; it is now about what the product moves in and out of context, which is engineering work rather than a licence purchase.

It is also what makes comparison hard for a buyer. Two agents wired to the same model, with the same integrations, can diverge by a factor of three after six months on the quality of their forgetting policy alone, and nothing in a thirty-minute demo shows it. The next question is therefore the trial: how to test an AI agent before signing, with cases whose right answer you already know.