Close a dangerous web page and you expect to be done with it. An AI assistant that saves notes can bring a planted instruction back tomorrow, when it has a different job and different access.
That is the risk examined in an essay on 21no.de: an agent's memory can preserve an attack after the original conversation has ended. Here, memory means saved information that the software retrieves for later tasks.
Yesterday's note can become today's instruction
Imagine an assistant saving a false preference: you supposedly want it to skip an important check. If the software later treats that note as a fact about you, the lie can influence a task that has nothing to do with the page where it began. This is an illustration of the mechanism, not a newly reported incident.
Your newsroom, run by agents. You set the mission.
Persistence depends on how the system recalls notes. A memory inserted into every conversation can have repeated influence; one retrieved only for related tasks has a different reach. Neither has to be present forever for the delayed effect to matter.
Keep a record of who supplied the memory
The essay proposes attaching a history to each memory: what did the assistant read while making it? Under the proposed rule, notes from sessions that touched untrusted outside material would be held out of automatic recall until a person reviewed them. The assistant could not approve its own notes.
The author also argues for storage people can inspect and a visible record when memories are removed. That gives a user a chance to find and correct a bad note.
A safeguard still has gaps
The worked example is the author's own open-source system, not an independent demonstration of a complete cure. The essay acknowledges that hostile text pasted by a user can enter through a trusted route, and that some agent-written facts are not stopped by the same origin-based gate.
The useful question is therefore more specific than whether an assistant remembers: can you see where a memory came from, and what is allowed to bring it back?