Agent memory grows a stack, and an attack surface

Elastic put a number on agent memory this week: 0.89 Recall@10 on question answering, from Atlas, the memory system it just open-sourced on top of Elasticsearch. That is the kind of metric that moves memory out of the “remember my name” demo and into something you’d wire behind a production agent, and the last day’s arXiv drop and vendor releases all point the same direction: memory is becoming an engineered subsystem with its own benchmarks, its own architecture debates, and now its own attack surface.

Atlas keeps three memory categories modeled loosely on cognitive science, integrates with agents over MCP, and isolates memories per user so one tenant’s history can’t bleed into another’s retrieval. The per-user isolation is the part worth noting, because most memory bolt-ons treat the store as a single shared index and discover the tenancy problem later. Elastic shipped it as a boundary from the start.

The architecture argument showed up in the research at the same time. Mandol, from the Institute of Software at the Chinese Academy of Sciences, targets a specific pain: most agent memory stacks glue a vector database to a graph database, which fragments the memory and pays cross-database I/O on every retrieval. Mandol collapses that into one memory-native structure that fuses key-value, vector, and graph in a single semantic data structure, with query routing and denoising that run without calling an LLM during retrieval. On LoCoMo and LongMemEval it reports the best overall accuracy among the systems it compares against, plus a 5.4x retrieval and 4.8x insertion speedup under 10 QPS concurrent load on consumer hardware. Keeping the LLM out of the retrieval path is the interesting design call: it makes latency predictable and the token budget explicit, which is exactly what breaks first when you put a chatty summarize-then-retrieve memory in front of a real workload.

Then the security side arrived to complicate all of it. A study titled Memory as an Attack Surface builds an agent with an external memory store and then poisons it with misleading entries before asking clean, well-formed multiple-choice questions. The queries are not adversarial; the memory is. Even simple corruptions moved the agent’s answers, dropping accuracy and pushing it toward the manipulated options. That is the flip side of every result above: the more an agent trusts what it retrieves, the more damage a bad write does, and memory writes are usually far less guarded than the prompt path everyone’s been hardening against injection. Per-user isolation like Atlas’s is one containment lever; validating what goes into memory in the first place is the harder open problem.

Away from memory, Google shipped a concrete answer to a question every agent team hits: how do you know a prompt tweak that fixed one bug didn’t regress ten others? The Agent Quality Flywheel is a developer skill your coding agent drives directly, running a five-stage loop, prepare data, run inference, grade with adaptive AutoRaters, cluster the failures, then apply targeted fixes, against production traffic or synthetic scenarios. You describe the testing goal in plain language and an independent evaluation service validates and counts the actual improvement rather than trusting the agent’s own account of whether it helped. The independence of the grader is the point; an agent scoring its own regression suite is how you ship a fix that breaks something adjacent.

Orchestration kept scaling out. Sourcegraph pushed Agentic Batch Changes into public beta, a single-prompt agent that rolls a change across hundreds or hundreds of thousands of repositories, self-heals against CI status and PR comments, and, notably, uses coding agents only where judgment is required and deterministic scripts everywhere else to save tokens. That split, model for the ambiguous edits and plain scripts for the mechanical ones, is the pragmatic version of what the routing papers have been circling, applied to a fleet-wide migration instead of a single task. On the smaller end, Assembled open-sourced 143.dev, the internal infrastructure it built for running coding agents as a team rather than as scattered per-engineer setups, after finding that everyone’s MCP connections, context, and automations had drifted into private silos nobody else could see.

The connective tissue this week is that agents are accumulating persistent state, and every subsystem that touches that state is being built out at once: storage, retrieval architecture, poisoning defenses, regression evals, and fleet orchestration. Worth watching is whether memory validation gets the same attention prompt-injection defense did over the past year, because the attack paper suggests the write path is now the soft target.