Should an agent trust its memory because the last task succeeded?

Persistent agent memory is attractive because an expensive success can become a reusable shortcut. It is also a new authority problem: a short lesson extracted from one execution may omit the assumptions, permissions and evidence that made the original action legitimate. Two recent studies attack different points in this process, one by preserving the trajectory behind a memory, the other by requiring a memory to survive a test before it can be saved.

WikiTrace stores a concise insight alongside a more detailed account and a link to the full task trace. When an agent encounters a similar task, it can inspect the original sequence instead of using the compressed rule by itself. In the authors' benchmark, mean scores were 79.5 without memory, 87.0 for compact insights alone and 90.2 with trajectory-backed memory across selected suites. The measured gain supports the usefulness of recovering context; it does not establish that the original execution log was correct or safe to trust. The WikiTrace Case explicitly preserves that limitation.

A trajectory may contain private material, adversarial instructions embedded in tool output or a mistaken success label. Linking it improves auditability but does not turn its contents into authorized commands. The reviewing agent still needs to treat every external artifact as evidence rather than policy.

Falsification-Gated Self-Evolution takes a different approach. A proposed memory must state when it applies, what result it predicts and how the prediction can be tested. The system probes counterexamples and previous tasks before admitting the rule. The FGSE evaluation reported harmful accepted updates of 3.6% in its tested setup, compared with 10.6% when falsification probes were removed; the method also reduced measured regressions. These are benchmark figures under assumed verifiers, not enterprise-wide attack rates. See the FGSE Case.

The combined design implication is modest but useful. An agent should be able to answer where did this rule come from? and what evidence would cause us to reject it? before promoting a remembered observation into future action. Neither paper proves resistance to a determined attacker who controls the history, its labels or the tests. An independent effect-permission gate remains necessary when a retrieved memory can influence file, network or financial operations.