Blog

notes on memory systems for ai agents

• Security·18 October 2026·6 min

  Ranking a poisoned memory lower is not a defense

  We planted one wrong answer per question in LongMemEval. Trust-weighted recall still put it first nine times in ten. Brain 0.5.0 keeps untrusted memories out until you approve them, treats remembered permissions as their own class, and checks every memory the agent cites.

• Benchmarks·7 September 2026·7 min

  We tried to add embeddings. Our own benchmark said no.

  A real embedding model, given every advantage, failed to beat BM25 on a 1,021-memory corpus with 1,000 distractors. Here is the experiment, the numbers, and what would change our mind.

• Concepts·8 August 2026·5 min

  When a memory stops being true

  Decay handles memories that fade. It doesn't handle memories that were true and then, on a specific day, weren't. Brain now models truth-based invalidation: supersede the old fact, keep it answerable, let the new one win.

• Distribution·8 August 2026·5 min

  One skill, every agent: Brain as a portable SKILL.md

  Brain already installed natively into a handful of coding agents. Now it ships as a single portable Agent Skill folder that runs unmodified across ~40 clients — the ones we support, and the ones we've never heard of.

• Security·7 August 2026·7 min

  Closing the loop on memory poisoning: quarantine, audit, and rollback

  The write-path gate stopped planted memories from entrenching. Now brain flags untrusted writes for review, detects the patterns an attack leaves behind, and can roll the whole brain back — all five OWASP ASI06 layers, shipped.

• Introduction·26 July 2026·9 min

  Introducing Brain Memory: a memory system that forgets on purpose

  AI agents start every session at zero. The usual fixes treat memory as storage plus search. Brain models it the way remembering actually works — decay, reinforcement, association — in plain files you can read.

• Security·26 July 2026·8 min

  Provenance, not filtering: hardening brain against memory poisoning

  A single email can plant a false memory in an AI agent and keep it there. Here is the attack, where brain was exposed, and the write-path gate we shipped in response.