Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents
Ahmad Al-Tawaha, Shangding Gu, Peizhi Niu, Ruoxi Jia, Ming Jin
Abstract
Safety evaluations of memory-equipped LLM agents typically measure within-task safety: whether an agent completes a single scenario safely, often under adversarial conditions such as prompt injection or memory poisoning. In deployment, however, a single agent serves many independent tasks over a long horizon, and memory accumulated during earlier tasks can affect behavior on later, unrelated ones. Studying this regime requires evaluation along the temporal dimension across tasks: not whether an agent is safe at any single memory state, but how its safety profile changes as memory accumulates across many independent interactions. We call this failure mode temporal memory contamination. To isolate memory exposure from stream non-stationarity, we introduce a trigger-probe protocol that evaluates a fixed probe set against read-only memory snapshots at varying prefix lengths, together with a NullMemory counterfactual baseline for identifying memory-induced violations. We apply this protocol across three deployment scenarios spanning records, memos, forms, and email correspondence and eight memory architectures, and additionally on Claw-like AI agents, such as OpenClaw, using the platform's native memory mechanism. Memory-enabled agents consistently exceed the NullMemory baseline, and memory-induced violation rates show a robust upward trend with exposure length on both agent classes. Order-randomization experiments indicate that the effect is driven primarily by accumulated content rather than encounter order. Finally, a structural consequence of the event decomposition is that memory-induced risk is detectable from retrieval state before generation, which we confirm with a high-recall diagnostic monitor. Our results argue for treating memory safety as a longitudinal property that requires temporal evaluation, not a single-state property that can be captured by a snapshot.
AI Impact Assessments
(1 model)Scientific Impact Assessment
Core Contribution
This paper identifies and formalizes temporal memory contamination — a non-adversarial failure mode where memory-equipped LLM agents become progressively less safe as benign memory accumulates across independent tasks over time. The key insight is that memory safety should be treated as a *longitudinal* property rather than a single-state snapshot property. The authors introduce a trigger-probe protocol that isolates memory accumulation effects from stream non-stationarity by evaluating a fixed probe set against read-only memory snapshots at varying prefix lengths, using a NullMemory counterfactual baseline to attribute violations specifically to memory.
This reframing is conceptually significant. Prior work on memory-related agent safety focused on adversarial settings (prompt injection, memory poisoning), whereas this paper demonstrates that *routine, benign* operation alone can produce monotonically increasing violation rates — a qualitatively different threat model with arguably greater practical relevance since it requires no attacker.
Methodological Rigor
The experimental design is thoughtful and addresses confounds systematically:
1. NullMemory counterfactual: The paired-run protocol (memory vs. no-memory, same model, same decoding parameters) provides a clean causal attribution mechanism. Cases where both runs violate are excluded, ensuring measured violations are genuinely memory-induced.
2. Stream non-stationarity control: The paper explicitly motivates the protocol by demonstrating (Figure 1) that naive temporal analysis on Enron data confounds memory effects with distribution shift. The read-only snapshot evaluation elegantly sidesteps this.
3. Order-randomization experiments: Block shuffle and full shuffle experiments disentangle content accumulation from encounter order effects, finding content is the primary driver while order is a secondary modulator (architecture-dependent).
4. Judge validation: 855 human-annotated evaluation pairs with ~91% pooled agreement, with detailed failure-mode analysis showing judge errors are predominantly false positives (inflating rates uniformly) and cannot create spurious temporal trends.
However, there are notable methodological concerns:
Potential Impact
Immediate practical implications: The finding that memory-induced violation rates increase monotonically with exposure length across 8 architectures and 2 agent classes has direct implications for deployment of persistent LLM agents (customer service bots, developer assistants, medical office systems). Organizations deploying such systems need temporal safety evaluation protocols.
Memory architecture design: The identification of retrieval scope and summarization level as the primary design factors associated with amplification provides actionable guidance. Broad semantic retrieval + aggressive summarization amplifies risk most; recency-biased retrieval is naturally protective. This creates an explicit utility-safety tradeoff framework.
Retrieval-time monitoring: The event decomposition insight — that memory-induced risk is structurally visible at retrieval time before generation — enables a practical mitigation strategy. The high-recall diagnostic monitor (0.970/0.984 recall) could be deployed as a safety filter without requiring response generation.
Broader influence: This work could catalyze a shift in how the community evaluates memory-equipped agents, from snapshot evaluations to trajectory-based assessment. The protocol is general enough to apply beyond the specific scenarios studied.
Timeliness & Relevance
This paper is exceptionally timely. Memory-equipped LLM agents (Mem0, MemGPT, OpenClaw) are being deployed at scale in 2025-2026, and the safety evaluation infrastructure has not kept pace. The paper addresses a genuine blind spot: most safety benchmarks evaluate single interactions or short sessions, missing the longitudinal dimension entirely. The inclusion of Claw-like agents (developer-facing autonomous agents with file system access) is particularly relevant given the rapid adoption of such tools.
Strengths
1. Novel problem formulation: Temporal memory contamination is a genuinely new safety concern that is well-motivated and practically important.
2. Rigorous experimental design: The trigger-probe protocol with NullMemory counterfactual is a clean, reusable evaluation methodology.
3. Breadth of evaluation: 8 memory architectures × 3 deployment scenarios + Claw-like agents with 4 LLM backends × 2 platforms provides substantial evidence for generality.
4. Actionable findings: The architecture-dependent amplification patterns and the retrieval-time monitor provide concrete guidance for practitioners.
5. Transparent limitations: The paper is candid about judge precision issues and the trigger-conditional nature of reported rates.
Limitations
1. Scale of probe sets: 40 probes per checkpoint and 20 probes for Claw-like agents is relatively small, potentially limiting statistical power for detecting subtle effects.
2. Limited model diversity: The base models for office-assistant scenarios are not extensively varied; the Claw-like experiments use 4 backends but with limited probes.
3. Mitigation evaluation is thin: The retrieval-time monitor is demonstrated but its deployment impact (e.g., false positive costs, utility degradation from filtering) is not evaluated.
4. No formal statistical tests: The paper reports trends and shaded bands but does not provide formal hypothesis tests for the monotonic increase claim.
5. Synthetic data dominance: Two of three office-assistant scenarios are synthetic, and real-world deployment conditions may differ substantially.
Additional Observations
The paper's event decomposition (precondition → trigger → violation) is a clean abstraction that could generalize beyond memory safety to other stateful agent failure modes. The extensive appendix with violation examples (spanning ~20 pages) provides valuable qualitative evidence and reproducibility support.
The F1 drop from Medical (0.692) to Registrar (0.573) for the event-structure monitor suggests domain sensitivity that warrants further investigation before deployment.
Generated May 19, 2026
Comparison History (25)
Paper 1 identifies a novel, fundamental failure mode in agentic AI (temporal memory contamination) and introduces a rigorous evaluation protocol for longitudinal safety. As long-term memory becomes standard in LLMs, establishing how accumulated context degrades safety will have profound implications across AI alignment, safety evaluations, and architecture design, offering broader scientific impact than Paper 2's application-focused data pipeline.
Paper 1 introduces a novel architectural framework (SR²AM) decomposing agentic reasoning into three systems with self-regulated planning, demonstrating dramatic efficiency gains (25-95% fewer tokens) while maintaining competitive accuracy against much larger models. This addresses a fundamental challenge in LLM agent design with broad applicability. Paper 2 identifies an important but narrower safety concern (temporal memory contamination) in memory-equipped agents. While valuable, it is primarily diagnostic rather than offering new capabilities. Paper 1's contributions to efficient reasoning architecture and the self-regulation principle have broader potential to influence agent design across the field.
Paper 1 offers higher scientific impact by identifying a novel, fundamental vulnerability in AI agents: temporal memory contamination. While Paper 2 provides a highly practical, production-validated framework for continuous learning from user feedback, it builds on established paradigms of interaction-based alignment. Paper 1 pioneers a new longitudinal evaluation paradigm for AI safety, demonstrating that risks compound over time across unrelated tasks. Its rigorous trigger-probe protocol and early detection mechanism provide foundational tools for future research in secure, long-horizon autonomous agents, making its conceptual contributions more broadly impactful.
Paper 2 presents a highly counter-intuitive 'capability paradox' where upgrading to smarter models degrades system security, a finding likely to spark significant discourse. Its identification of 'semantic hijacking' and the robust mediation analysis explaining the mechanism offer profound insights into multi-agent system vulnerabilities. Furthermore, it proposes a novel defense mechanism with striking empirical success. While Paper 1 addresses an important temporal issue, Paper 2's unexpected findings and actionable architectural solutions give it a broader and more disruptive potential impact across AI safety and multi-agent systems research.
Paper 1 introduces a novel, generalizable framework for understanding LLM planning by extracting search trees from reasoning traces, revealing a fundamental dissociation between LLM and human planning (myopic vs. deep search). This provides deep mechanistic insight into how reasoning models actually work, with broad implications for improving LLM reasoning capabilities. Paper 2 identifies an important but more incremental safety concern (temporal memory contamination) in memory-equipped agents. While practically relevant, Paper 1's methodological innovation and fundamental insights into LLM cognition have broader scientific impact across AI, cognitive science, and alignment research.
Paper 1 is likely to have higher impact due to timeliness and direct real-world relevance: memory-equipped LLM agents are rapidly deploying, and longitudinal safety failures are a practical, under-evaluated risk. It offers a concrete evaluation protocol (trigger-probe, NullMemory baseline), tests across multiple scenarios and memory architectures, and provides an actionable diagnostic insight (risk detectable pre-generation). Paper 2 is conceptually novel and cross-modal, but its central hypothesis may be harder to validate broadly and translate into immediate applications compared to Paper 1’s deployment-facing methodology and safety implications.
Paper 1 identifies a novel and critical safety vulnerability in long-horizon LLM agents (temporal memory contamination). Given the rapid adoption of memory-equipped autonomous agents in real-world applications, exposing and mitigating longitudinal safety risks has profound and broad implications for AI safety. While Paper 2 offers a valuable methodology for scientific reasoning in physics, Paper 1 addresses an overarching, urgent systemic risk that affects the broader deployment of LLM agents across multiple domains.
Paper 2 likely has higher scientific impact: it identifies a deployment-realistic, under-evaluated safety failure mode (temporal memory contamination) and proposes a general evaluation methodology (trigger-probe + NullMemory) applicable across memory architectures and agent platforms. Its implications span safety, agent design, evaluation standards, and monitoring, making it broadly relevant and timely given rapid adoption of memory-equipped agents. Paper 1 is innovative and shows strong benchmark gains, but is narrower (RLVR post-training via population self-play) and more incremental within existing LLM training paradigms, with less immediate cross-field impact.
Paper 1 targets a high-stakes, under-evaluated regime: longitudinal safety in memory-equipped LLM agents, introducing a clear new failure mode (temporal memory contamination) and an evaluation methodology (trigger-probe + NullMemory counterfactual) that can become a standard for deployed agents. Its findings generalize across scenarios, memory architectures, and agent platforms, and it yields actionable monitoring hooks (pre-generation retrieval-state diagnostics). This is timely as memory/personalization is rapidly deployed, and the work impacts safety, evaluation science, and real-world agent deployments. Paper 2 is strong but narrower to factuality metrics and internal steering.
Paper 1 addresses a highly timely and critical issue: longitudinal safety risks in memory-equipped LLMs. As LLM agents with long-term memory become ubiquitous, understanding 'temporal memory contamination' will have broad impact across AI safety and deployment. Paper 2, while methodologically sound, focuses on RL in specific economic environments (e.g., hotel pricing), giving it a narrower scope and likely fewer immediate real-world applications across diverse fields compared to the universal relevance of LLM safety.