By Rob Arnold, Founder & CEO, Ascendea
Your AI can learn something today and completely forget it tomorrow.
Picture this. An AI agent spends forty minutes fixing a difficult problem. It finds the cause, corrects the mistake, runs the tests, and finishes the job properly. You close the session, satisfied. The next morning, it makes the exact same mistake again.
The model did not suddenly become less intelligent overnight. The lesson simply disappeared when the session ended.
This is the quiet problem sitting behind almost every serious AI agent in use today. These systems can reason, use tools, write code, run long loops, and work productively for hours. But without a proper memory system, none of that experience carries forward. Every session starts from zero.
And here is the part that surprises most people: saving the whole conversation does not fix it. In long-memory testing, models often perform worse when they are forced to reread everything. The real skill is finding the one small lesson that matters right now.
That is what memory engineering does. It teaches an AI system what to keep, what to recall, what to update, and what to forget, so the next session begins with experience instead of starting from scratch.
This article explains how that works, in plain English, and what you can practically do about it in your own business. You do not need to be a developer to act on any of it.
Why This Matters Commercially, Not Just Technically
Before the concepts, the business case.
If you are paying for AI, you are paying by the token. A token is roughly three-quarters of a word, and you are charged for everything the model reads as well as everything it writes. That means every piece of context you send costs money, on every single call, forever.
To put real numbers on this, here is what the main models charge per million tokens as of August 2026:
| Model | Provider | Input (per 1M tokens) | Output (per 1M tokens) | Context Window |
|---|---|---|---|---|
| GPT-5 | OpenAI | $1.25 | $10.00 | 1M tokens |
| GPT-4o | OpenAI | $2.50 | $10.00 | 128K tokens |
| GPT-4o mini | OpenAI | $0.15 | $0.60 | 128K tokens |
| GPT-4.1 | OpenAI | $2.00 | $8.00 | 1M tokens |
| GPT-4.1 mini | OpenAI | $0.40 | $1.60 | 1M tokens |
| Claude Sonnet 5 | Anthropic | $3.00 | $15.00 | 200K tokens |
| Claude Sonnet 4 | Anthropic | $3.00 | $15.00 | 200K tokens |
| Claude Haiku 3.5 | Anthropic | $0.80 | $4.00 | 200K tokens |
| Gemini 2.5 Pro | $1.25 | $10.00 | 1M tokens | |
| Gemini 2.0 Flash | $0.10 | $0.40 | 1M tokens | |
| Grok 4.5 | xAI | $3.00 | $15.00 | 256K tokens |
| Llama 4 Scout | Meta (open) | Free (self-hosted) | Free (self-hosted) | 10M tokens |
Note: Claude Sonnet 5 is at introductory pricing of $2.00/$10.00 through 31 August 2026, rising to $3.00/$15.00 from 1 September. Prices shown are standard rates and may differ on volume agreements.
The numbers that matter for memory engineering are the input costs. Every token of memory you inject into a prompt is charged at the input rate, on every single call. If your agent makes 50 calls per task and you are injecting 5,000 unnecessary tokens of memory each time, that is 250,000 wasted input tokens per task. On GPT-4o, that is $0.63 per task in pure waste. Run 100 tasks a day and you are burning $63 daily — over $1,500 per month — on context your model is not even using effectively.
Here is the trap. The obvious way to give an AI memory is to write everything down in one long file and paste it in at the start of every conversation. It feels sensible. It is also expensive and it degrades quality.
A measured test published by the memory platform Mem0 makes the point concretely. Using a 24-entry memory file, the naive approach of dumping the whole file into every call consumed 594 prompt tokens per call. Retrieving only the five relevant entries consumed 166 tokens. That is a 72 percent reduction, and both approaches produced the correct answer. The pattern scales badly in the wrong direction: on a 200-entry store, the full dump injects roughly 4,600 tokens of memory content per call, while selective retrieval stays around 130 tokens.
Note the honest framing there. This is a small-scale measurement published by a company that sells memory infrastructure, and I would treat the headline percentage as directional rather than gospel. But the underlying arithmetic is not controversial. Naive memory grows linearly and gets charged on every call. Selective memory stays flat.
The second cost is quality, and it is the one business owners underestimate. Chroma published a technical report in July 2025 testing 18 leading models, including GPT-4.1, Claude 4, Gemini 2.5 and Qwen3, on deliberately simple tasks where only the input length varied. The finding was consistent across every model tested: performance degraded as input length grew. They named it context rot.
“Models do not use their context uniformly; instead, their performance grows increasingly unreliable as input length grows.”
Anthropic’s engineering team describes the same phenomenon as an attention budget. Every token you add depletes it. Their guidance is blunt: good context engineering means finding “the smallest possible set of high-signal tokens that maximise the likelihood of some desired outcome”.
So the business case has two halves. Better memory costs less and works better. That is an unusually comfortable position to be in, and it is why this topic is worth an hour of your attention.
Context Is Not Memory: The Distinction That Changes Everything
This is the single most useful idea in the whole article, so let me give it a proper business analogy.
Context is the desk. It is what your AI has in front of it right now: the current instruction, the recent conversation, the documents you attached, the tools available. Big models now have very large desks, some measured in millions of tokens. But a desk, however large, gets cleared at the end of the day.
Memory is the filing cabinet, the CRM, and the staff handbook. It persists. It is organised. It is searchable. And critically, you do not put the entire filing cabinet on the desk every morning. You take out the two files you need.
Most businesses using AI today have a very large desk and no filing cabinet at all. They compensate by re-explaining themselves every morning, which is exactly what re-pasting a long brief into a fresh chat amounts to.
The distinction has practical consequences that show up directly in your invoice and in your output quality.
| Context (the desk) | Memory (the filing cabinet) | |
|---|---|---|
| Lifespan | Ends with the session | Persists indefinitely until changed |
| Cost model | Paid for on every single call | Paid for on write, and only when read |
| Size behaviour | Quality falls as it grows | Quality improves if well maintained |
| What belongs here | The task at hand, retrieved facts, current instruction | Decisions, preferences, standards, past outcomes, lessons |
| Failure mode | Context rot, lost detail, high cost | Stale facts, contradictions, clutter |
The academic framing worth knowing is the CoALA framework from Princeton researchers Sumers, Yao, Narasimhan and Griffiths, published in TMLR. It separates agent memory into modular components and, importantly, organises memory by what it represents rather than where it is physically stored. That is a genuinely useful instruction for a business owner: decide what the AI needs to remember in business terms first, and worry about the database later.
The Four Types of Memory Every Useful Agent Needs
Every capable agent needs four kinds of memory. They map surprisingly cleanly onto how a well-run business actually stores knowledge.
1. Working Memory: The Desk
This is what the agent holds right now, inside the context window. The current request, the last few exchanges, the immediate task state. It vanishes when the session ends, and that is fine. Working memory is not meant to last.
The business equivalent is the notepad in front of you during a client call.
2. Semantic Memory: The Facts
This is what is generally true. Your pricing structure. Your service terms. Your product specifications. Your supplier lead times. The fact that your busiest month is November and your quietest is January.
Semantic memory persists across sessions and is not tied to any particular conversation. In production systems, it is usually the largest store by volume, because the facts a business accumulates over months quickly outgrow any context window.
The business equivalent is the staff handbook and the price list.
3. Episodic Memory: The History
This is what happened. On the fourteenth of March, this customer complained about a late delivery, we offered a partial credit, and they accepted. Last quarter, we tried a Facebook campaign for the trade audience and it did not convert.
Episodic memory is where personalisation lives, and it needs a time dimension as well as a subject. Without the temporal layer, an agent retrieves facts it once knew but cannot place in time, which produces confidently wrong answers.
The business equivalent is the CRM activity log and the meeting notes.
4. Procedural Memory: The Method
This is how things are done here. The order in which you qualify a lead. The three checks before an invoice goes out. The tone you use in complaint responses. The escalation rule that anything over five thousand pounds goes to a director.
Procedural memory is the closest thing to institutional muscle memory, and it is the most commercially valuable of the four for an SME, because it is the type that captures the way your business actually runs. Most tools bake it into the system prompt. More capable setups extract patterns from accumulated history and update the method over time, so the agent gets better at routine work the more it does it.
The business equivalent is your standard operating procedures.
| Memory type | Question it answers | SME example | Where it usually lives |
|---|---|---|---|
| Working | What am I doing right now? | The current customer enquiry | Context window |
| Semantic | What is true? | Pricing, terms, product specs | Vector store or documents |
| Episodic | What happened? | This client’s complaint history | Database with timestamps |
| Procedural | How do we do this? | Quoting process, escalation rules | Instruction files or skills |
Here is the useful diagnostic. Take any AI tool you currently use and ask which of these four it actually has. In my experience most SME deployments have working memory only, plus perhaps a document search bolted on the side. That is why they feel clever in the demo and disappointing in month three.
How to Stop an Agent Repeating the Same Mistake
Back to the forty minutes of wasted work. Why does it happen, and what actually fixes it?
The naive fix is to save the transcript. This fails for two documented reasons, and both have proper names now, thanks to a paper from Stanford, SambaNova and UC Berkeley researchers presented at ICLR 2026.
The first is brevity bias: when you summarise a session, the summary keeps the shape of what happened and throws away the specific domain insight that made it valuable. The second is context collapse: when you repeatedly rewrite the same memory file, detail erodes with each pass until the file is a bland shadow of what it started as.
I suspect every business owner who has ever watched a process document get “tidied up” through four revisions until it says nothing useful will recognise both failures immediately.
The paper’s answer is a framework they call ACE, Agentic Context Engineering, and the core idea translates beautifully to business language: treat memory as an evolving playbook rather than a summary. The playbook accumulates specific strategies, refines them, and organises them, using structured incremental updates rather than wholesale rewrites. Across their benchmarks this produced a 10.6 percent improvement on agent tasks and 8.6 percent on finance tasks, while reducing adaptation cost. Notably, it learned without labelled training data, using nothing but the natural feedback of execution results.
Translated into something you can act on tomorrow, the anti-repeat-mistake loop looks like this.
Detect. Something goes wrong, or nearly goes wrong. The agent produces a quote with the wrong VAT treatment, or emails a customer a template meant for a different product line.
Extract the lesson, not the transcript. The output should be one specific, atomic, reusable rule. Not “the conversation about VAT on 14 March”. Instead: “Training services supplied to businesses outside the UK are outside the scope of UK VAT; check customer location before applying 20 percent.”
Write it to the playbook, in the right place. Appended as a new entry, not merged into a paragraph that swallows it.
Retrieve it when relevant. Next time a quote is being prepared, that rule surfaces because it is about quoting, not because someone remembered to mention it.
Review it. A human checks the playbook periodically. This is not optional, and I will explain why in the section on safety.
The habit that pays back fastest here is writing lessons as atomic facts. One rule per entry, phrased so it makes sense on its own with no surrounding conversation. CrewAI’s memory system does this automatically, breaking raw task output into discrete statements before storing them, precisely so that atomic facts are stored rather than one large blob. You can do the same thing by hand in a text file, and it works.
Storing and Retrieving Only the Right Information
If memory is a filing cabinet, retrieval is the filing clerk. A brilliant cabinet with a poor clerk is useless.
There are four ways to store memory, and they are complements rather than competitors.
Files
Plain text or Markdown files that the agent reads. Unfashionable, and genuinely excellent for procedural memory and standards.
Do not dismiss this as the beginner option. Letta, a company built specifically on agent memory research, announced in March 2026 that it was moving memory away from specialised database tools and towards general file operations over version-controlled files, which they call context repositories. Anthropic’s Claude Code uses a similar pattern, dropping a project instructions file into context up front and then fetching other files on demand.
Files are readable by humans, diffable, version-controlled, and free. For an SME, this is where I would start.
Vector stores
The tool for semantic search. Text is converted into numerical representations called embeddings, and retrieval finds entries whose meaning is closest to your question, rather than matching keywords. This is what lets an agent find “our returns policy” when the customer asked “can I send it back”.
Strengths are speed, immediate usefulness with no setup modelling, and handling any kind of content. Weaknesses are that relationships are invisible to it. To a vector store, “revenue” and “ARR” are merely similar, not the same thing, and multi-step questions that require following a chain of connections are structurally out of reach.
Common options include Chroma, Qdrant, Pinecone, Weaviate, and pgvector, which runs inside an ordinary Postgres database.
Knowledge graphs
The tool for relationships. Information is stored as entities and the named, directed connections between them: this customer belongs to this parent company, which holds this contract, which is managed by this account manager.
Graphs answer questions vector search cannot. “Which of our customers are subsidiaries of a group that also buys from our competitor” is not a similarity question. Zep’s Graphiti framework adds a time dimension to this, attaching validity intervals to every relationship so facts are marked as superseded rather than deleted, which allows questions like “what was this customer’s address before they moved”.
The trade-off is real: graphs need a cold start, need someone to decide the structure, and cost more to maintain.
MCP: the plumbing that ties it together
Model Context Protocol is an open standard that lets AI tools connect to external systems, including memory stores, through a common interface. It matters to you for one specific commercial reason: portability.
Today, your memory is trapped inside whichever assistant created it. Each tool learns a different slice of your business and none of them can see the others. There is an official MCP memory server that stores a knowledge graph of entities, relations and observations in a local file, which any MCP-compatible client can then read and write. Mem0 offers a comparable local-first option called OpenMemory that works across Claude Desktop, Cursor, VS Code and similar tools.
Put simply: MCP is how you stop renting your own institutional knowledge from a vendor.
The retrieval discipline
Storage is the easy half. Retrieval is where quality is won or lost, and the principle is uncomfortable for people who like completeness.
A vector search returning fifty marginally relevant memories is worse than one returning five highly relevant ones.
Modern systems combine several retrieval signals rather than relying on similarity alone: semantic similarity, keyword matching, entity matching, recency weighting, and metadata filters such as customer, project or date range. CrewAI exposes this as an explicit formula, ranking results by a weighted blend of similarity, recency decay and importance, and lets you tune the weights differently for fast-moving projects versus long-lived reference knowledge.
You do not need to implement any of that yourself. You do need to know it exists, because “why did it not find the right thing” is nearly always a retrieval-tuning question, not a model question.
How Memory Reduces Unnecessary Token Spending
Four mechanisms save real money, and they stack.
First, selective retrieval instead of full injection. This is the 594-tokens-to-166-tokens effect described earlier. The saving grows every week your memory store grows, because naive injection scales linearly while retrieval stays roughly flat.
Second, progressive disclosure. Load the index, not the encyclopaedia. Anthropic’s Agent Skills documentation puts precise numbers on this pattern. A skill’s name and description cost roughly 100 tokens and are always loaded. The full instruction body costs under 5,000 tokens and loads only when triggered. Bundled reference files and scripts cost nothing at all until accessed, and when a script runs, only its output enters the context, never its code. The consequence is that you can install a large library of specialist procedures without paying a context penalty for the ones you are not using today.
Third, prompt caching. When the stable part of your prompt does not change between calls, providers can reuse the processed version at a discount. Published cache-hit discounts across major providers range from roughly 50 to 90 percent off standard input pricing, with Anthropic’s cache reads priced at 90 percent below base input tokens and OpenAI’s at 50 percent, though cache writes carry a premium and caching requires exact prefix matching.
The design implication is neat and worth understanding even if you never implement it yourself: put the stable memory first in the prompt, and the volatile retrieved memory afterwards. The stable part then becomes cacheable.
Fourth, and most interesting because it inverts the usual cost logic, is doing the thinking when nobody is waiting. Letta’s research on sleep-time compute proposes that agents use idle periods to reorganise what they have learned, turning raw context into what the researchers call learned context. Because the processing happens off the clock, you can afford a slower, stronger model for the thinking and a faster, cheaper model for the live conversation. For a business, that is the difference between doing your filing at two in the morning and doing it while the customer waits on the phone.
| Approach | Token cost per call | Quality effect | Best for |
|---|---|---|---|
| Paste everything into context | Highest, grows linearly | Degrades as it grows | Nothing, beyond a quick test |
| Summarise the conversation | Moderate | Loses specific detail | Long conversational threads |
| Selective retrieval | Low, stays roughly flat | Improves with tuning | Most business use cases |
| Progressive disclosure of procedures | Very low until triggered | Strong for method knowledge | Standards, SOPs, checklists |
| Prompt caching on stable blocks | Discounted on repeats | Neutral | High-volume repeated prompts |
The Current Tool Options
A word of caution before the table, because this market has a credibility problem you should know about.
Vendor benchmark claims do not agree with each other, and the gaps are not small. Mem0 reports 94.4 percent on the LongMemEval benchmark using its April 2026 algorithm. Zep’s documentation reports 90.2 percent for Graphiti-based retrieval on the same benchmark. An independent evaluation cited by a third party measured the same two systems at 49.0 percent and 63.8 percent respectively. A fourth vendor publishing that comparison then claimed 94.6 percent for its own product.
I cannot reconcile those numbers, and I would not trust anyone who claims they can from the outside. Different test conditions, different underlying models and different versions all move the figures. The honest conclusion for an SME is simple: benchmark claims in this category are marketing until you have tested them on your own data. Run a small pilot with your real questions before committing.
With that caveat firmly in place, here is the current picture.
| Tool | What it is | Strength | Watch out for | Indicative cost |
|---|---|---|---|---|
| Plain files | Markdown or text the agent reads | Free, readable, version-controlled, no lock-in | Manual discipline required; no semantic search | Nothing |
| MCP memory server | Official knowledge graph server storing entities, relations and observations locally | Portable across tools; private; free | Basic; file grows and needs pruning | Nothing |
| Mem0 | Managed and open-source memory layer | Large community; many integrations; fully self-hostable under Apache 2.0 | Graph features gated to the top tier | Free tier; $19/month; $249/month Pro |
| Zep / Graphiti | Temporal knowledge graph memory | The strongest handling of facts that change over time; SOC 2 Type II; signs DPAs with EU customers | Self-hosting means running your own graph database | Free tier; Flex from ~$104/month billed annually |
| Letta | Open, model-agnostic agent framework with persistent memory | Memory as version-controlled files; not tied to one model provider | Pivoted substantially in 2026; older features deprecated | Open source |
| CrewAI memory | Unified memory inside the CrewAI agent framework | Automatic consolidation, importance and recency scoring, explicit forget command | Requires the CrewAI framework | Open source |
| LangChain / LangGraph | Memory modules within a widely used framework | Flexible; many storage backends | Developer-oriented | Open source |
| Vector stores | Chroma, Qdrant, Pinecone, Weaviate, pgvector | Fast semantic search; low setup cost | No relationships; no time model | Free self-hosted upward |
| n8n | Visual automation platform with agent memory nodes | Genuinely accessible without coding; memory visible on the canvas | One memory sub-node per agent; add vector stores as tools | Free self-hosted; cloud tiers |
| Built-in assistant memory | ChatGPT, Claude, Gemini memory features | Zero setup; already included | Locked to each vendor; limited visibility and control | Included in subscription |
Two notes on that last row. All three major assistants now have memory features, and they take genuinely different approaches: one favours automatic background synthesis, one favours visible individual entries you can edit, and one ties memory to your wider account. Reporting also indicates that memory does not synchronise between them, and where import features exist they are one-time snapshots rather than a live link. Because these features change frequently, check the current settings in your own account rather than relying on any article, including this one.
The second note is a governance point that catches teams out. On team plans, “private from memory” does not necessarily mean private from your administrator; incognito or temporary chats may still appear in organisational data exports and follow your retention policies. Tell your staff that before someone learns it the hard way.
Practical Setup: What to Actually Do
Here is a sequence that a non-technical business owner can genuinely follow. It is deliberately ordered so that each stage delivers value before you spend money on the next.
Stage one: write the four files (an afternoon, no cost)
Create four plain Markdown files in a shared folder. This is your memory system, and it will get you further than you expect.
business-facts.md is semantic memory. What you sell, at what price, on what terms, in which territories, with what lead times. Non-negotiable constraints. Anything you find yourself re-typing to an AI belongs here.
how-we-work.md is procedural memory. Your processes, written as numbered steps. Your tone of voice, with two or three examples. Your escalation rules. Your approval thresholds. Words and phrases you never use.
decisions.md is episodic memory, filtered for what matters. One line per entry, dated. “March 2026: chose monthly billing over annual for the SME tier because cash flow objections were killing deals.” This file is where your institutional reasoning lives, and it is the file that stops you relitigating settled questions.
lessons.md is your anti-repeat-mistake playbook. One atomic rule per line, dated, phrased so it stands alone.
Then adopt one habit: at the end of any substantial AI session, ask the assistant to propose entries for lessons.md and decisions.md. Review the proposals yourself. Paste in the ones that survive scrutiny.
That last sentence is the whole discipline. The AI drafts; you approve.
Stage two: make the files load automatically (a morning)
Manual pasting will not survive contact with a busy week. Depending on your tools, use project-level instructions or custom instructions in your assistant, a project instruction file that your coding tool reads automatically, or a skill folder containing a structured instruction file plus supporting references.
The goal is that the right standards arrive without anyone remembering to fetch them.
Stage three: add search when the files get too big (a day, with help)
You will know when. The symptom is that the files are now long enough that pasting them wholesale is either costing noticeable money or diluting quality.
At this point add semantic retrieval so only the relevant few entries are pulled in. If you already run automation in a platform like n8n, this is a matter of connecting a vector store node and pointing the agent at it as a tool. If you want a managed service, Mem0’s free tier is enough to prove the concept before you commit to anything.
Stage four: add relationships or time, only if you need them (a project)
Move to a graph-based system when your genuine questions involve connections between entities, or when you need to know what was true at a particular point in the past. Multi-entity B2B relationships, contract histories, regulated audit trails, and long customer lifecycles are the honest use cases. Simple personalisation is not.
Stage five: instrument it
Three simple controls, all of which matter more than they sound.
Track tokens per call and set an alert if it rises meaningfully above your baseline, because a sudden spike usually indicates a retrieval fault rather than genuine growth in usage. Log the misses, meaning every occasion when the agent says it does not know something it should; that log is the most valuable dataset you will have for improving retrieval. And review the memory store monthly, as a diary appointment, not an aspiration.
Making Memory Update Itself, and Forget Safely
An agent that remembers everything is an agent that recalls badly. This is not a storage argument, it is a quality argument. Every additional entry in the store is another candidate competing to be surfaced, and most of them are noise for any given question.
The cognitive science here is genuinely instructive. Robert and Elizabeth Bjork’s New Theory of Disuse distinguishes storage strength, how well a memory is laid down, from retrieval strength, how easily it can be reached right now. Storage strength does not decay. Retrieval strength does, and that decay is adaptive rather than accidental: lowering the accessibility of rarely used items is how the brain avoids being paralysed by interference.
That is a design specification for a business memory system. You do not need to delete your history. You need the rarely relevant parts to stop shouting.
There are four practical mechanisms, and each fails in a characteristic way.
| Mechanism | How it works | Good for | Fails when |
|---|---|---|---|
| Time expiry | Delete anything older than a set period | Enforcing retention policies and data protection commitments | The fact is old but still true, such as a customer’s allergy or a billing structure |
| Recency decay | Down-rank what has not been used lately; access resets the clock | Fast-moving work where relevance shifts | A rare but critical fact gets quietly buried |
| Importance scoring | Score entries at the point of capture and drop low scores | High-signal capture pipelines | Scoring drifts when the model or prompt changes |
| Supersession | When a new fact contradicts an old one, replace or mark it superseded | Preferences and profile data | It mistakes temporary states for permanent change, or waits for a contradiction that never arrives |
The rule of thumb worth remembering is this: passive ageing is for noise, active forgetting is for facts. Let low-value chatter fade automatically. Make deliberate decisions about actual facts.
A sensible combined policy for a small business looks like: time-based expiry on transactional detail to honour your retention promises, recency-based down-ranking so old material stops crowding retrieval, and contradiction handling at the moment of writing so opposing statements never accumulate side by side. Add one safeguard on top: an importance floor, so anything marked critical cannot be aged out on time alone.
Three failure patterns are worth watching for specifically, because they are the ones customers notice. Over-eager forgetting produces “I told you this yesterday” and is nearly always an expiry window set shorter than your real business cycle. Stale facts surviving produces an agent still referencing a customer’s old address, and happens when a system waits for an explicit contradiction that the customer never volunteers. Stacked contradictions produce inconsistent behaviour, because both “prefers brief replies” and “prefers detailed replies” are sitting in the store and retrieval keeps surfacing both.
Good tooling handles this reasonably well now. CrewAI checks each new memory against similar existing entries and lets the model decide whether to keep, update, delete or add alongside, with a separate cheap check that silently drops near-identical duplicates. Mem0 uses a comparable four-way decision at the point of writing, and separately offers a decay feature that re-ranks rather than deletes, boosting recently used memories and dampening unused ones without removing anything. Zep’s approach invalidates facts rather than deleting them, which preserves the audit trail.
Two Safety Points I Will Not Soften
If you let an AI write its own memory, you have created a new attack surface, and this deserves plain speaking rather than reassurance.
Memory poisoning is a proven, published attack. Researchers behind PoisonedRAG demonstrated that injecting five malicious texts per target question into a knowledge database containing millions of texts achieved a 90 percent attack success rate in making the system return the attacker’s chosen answer. Their paper, appearing at the USENIX Security Symposium in 2025, also found that the defences they tested were insufficient.
Think about what that means in a business context. A false “fact” written into memory once becomes the authoritative answer in every future session. It does not look like a hack. It looks like your AI being confidently, consistently wrong about your own pricing.
The practical defences are unglamorous and effective. Validate what gets written, rejecting entries containing instructions, links or code-like patterns. Never let untrusted content, such as an inbound email or a scraped web page, write directly to memory without a human in between. Keep a human review of the memory store on a schedule. And be careful about anything the agent picked up while browsing.
Personal data in memory is regulated data. If your agent remembers things about named customers, that memory is personal data under UK GDPR, and the right to erasure applies to it. This is technically awkward: deletion from a vector store is genuinely harder than deleting a database row, and there is a live gap between the legal obligation and what current tooling proves it can do.
The pragmatic approach for an SME is to keep personal data out of the general memory store wherever you reasonably can, and keep it in your CRM where you already have controls, retention rules and a deletion process. Have your AI memory reference the customer record rather than duplicate it. Where you must store personal data in memory, prefer tools that offer clear per-record deletion, tag entries so you can find and remove them by customer, and check that your provider will sign a data processing agreement.
If you are in a regulated sector, take proper advice on this rather than relying on a business article.
What This Looks Like in Real SMEs
Enough theory. Five patterns I regard as genuinely achievable this quarter.
The professional services firm that stops re-explaining itself. A consultancy of twelve people writes down its methodology, its report structure, its tone, and its client-specific quirks as procedural memory. New AI-assisted drafts arrive in house style on the first attempt rather than the fourth. The measurable benefit is not the drafting time, it is the review time.
The trade business whose quoting stops leaking margin. A specialist installer maintains a lessons file capturing every quoting error: the access surcharge for third-floor properties, the material that always arrives two weeks late in winter, the customer type that always negotiates on payment terms. Each entry is one line, added the day the lesson is learned. The quote assistant retrieves the relevant three or four rules for each job. This is the highest-return application I see in practice, because quoting errors cost real cash and the same handful repeat endlessly.
The customer service function with actual continuity. An e-commerce business gives its support assistant episodic memory tied to the customer record: previous issues, previous resolutions, previous goodwill gestures. The customer stops re-explaining their problem. Note that this is precisely the case where personal data discipline matters most, so reference the CRM rather than duplicating it.
The voice agent that does not sound like it has amnesia. Voice is where missing memory is most brutally obvious, because the caller cannot scroll back or paste in context; if the agent does not remember, the friction is immediate and audible. A returning caller being asked to spell their company name for the third time is a churn event, not a minor irritation.
The owner who stops being the single point of failure. This is my favourite, and the least technical. Every decision of consequence gets one dated line in a decisions file, with its reasoning. Within six months you have something no SME normally possesses: a searchable record of why the business is arranged the way it is. That is genuinely useful for onboarding, for succession, and for the moment a new manager proposes something you tried in 2024 for good reasons that nobody wrote down.
Where This Is Going, and What Remains Unsolved
Three honest observations about the direction of travel.
Memory has become a distinct discipline rather than a feature. A major survey published in December 2025 and revised in January 2026, with contributors from Fudan, Oxford and elsewhere, argues that agent memory research has become substantial enough to need its own taxonomy, and that the old short-term versus long-term split is no longer adequate. Anthropic’s engineering guidance treats context as a finite resource to be managed deliberately. This is no longer a niche concern.
The industry is converging on hybrid architecture. The argument about vector stores versus knowledge graphs has largely settled into using both: semantic search to find the entry points, relationship traversal for depth. If a vendor tells you one approach solves everything, that is a useful signal about the vendor.
And several problems remain genuinely open. Facts that were true and quietly became false are hard to catch, because nothing triggers a correction. Understanding change as an evolution rather than a simple replacement is still poor. Recognising the same person across devices and anonymous sessions is unsolved. And performance degrades measurably as memory scales: on one benchmark that tests at both one million and ten million token scales, scores fell from 64.1 to 48.6 as the scale increased tenfold.
None of that is a reason to wait. All of it is a reason to start simple, keep humans in the loop, and avoid building your business on a single vendor’s memory format.
The Practical Summary
If you take one action from this article, take the first one.
- Write four files this week. Facts, method, decisions, lessons. Plain Markdown, shared folder, no tooling required.
- Adopt the one habit. At the end of every substantial AI session, ask for proposed lessons and decisions. Review them. Keep the good ones.
- Make them load automatically. Project instructions, custom instructions, or a skill folder. Remove the reliance on human memory.
- Add retrieval when the files outgrow pasting. Selective retrieval over full injection saves money and improves quality simultaneously.
- Add relationships or time only when your real questions need them. Not before.
- Decide your forgetting policy deliberately. Expiry for compliance, decay for clutter, supersession for facts, with an importance floor for the critical few.
- Guard the write path and keep personal data in the CRM. A human approves what enters permanent memory.
Context is the desk. Memory is the filing cabinet. Almost every business using AI today has an enormous desk and no filing cabinet, and it is costing them twice: once in tokens, and once in the quiet, repeated cost of an assistant that never gets any better at working with them.
The good news is that the first version of the fix is four text files and one new habit. You can start this afternoon.
Rob Arnold is Founder and CEO of Ascendea, working with small and medium-sized businesses on AI systems, AI voice agents, and all-in-one CRM. Powered by Manus.





