Test shows AI memory tools often let corrected facts come back

A tester checked whether AI agent memory tools truly forget a fact once it's corrected, and found many do not. The easy case everyone handles: you say the region is Frankfurt, then correct it to Ohio — a good memory system should answer Ohio afterward. The harder case almost nobody checks: what happens if the old value gets mentioned again later, not as an attack, just a user repeating a preference they forgot they'd changed, or one stray old line buried in a long chat. Does the dead value, Frankfurt, come back?

There's a concrete reason it can: cosine similarity, the common method for comparing meaning between texts, is bad at telling a contradiction apart from a simple duplicate — one cited paper measured this at an AUROC of about 0.59, barely better than a coin flip. A corrected value often reads as more similar to the original than an ordinary rephrase would, so a similarity-based memory store has no clean way to tell that the repeated old value is actually a dead fact resurfacing. This isn't just theoretical: memory poisoning is an active 2026 security topic, listed by OWASP, and an attack called MINJA reportedly succeeds at injecting an agent's memory 98.2% of the time. To measure this directly, the author built a small benchmark: state a fact, correct it, then restate the old value, scoring at the answer level with 30 test cases run locally.

The metric, echo-resistance, measures how well the corrected value sticks, where 1.0 is ideal. The author's own simple keyed memory store scored 0.00 with safety checks turned off — a complete failure, because the restatement was the most recent write and simply overwrote the correction.