Correct retrieval from memory does not guarantee correct memory maintenance. An agent can produce the right answer because the latest passage happens to be available, while its durable memory still contains an outdated or contradicted fact. FEB-30 measured both the internal memory state and answers to questions after a sequence of updates, rather than…
Inspect the ClaimsCase · DiggingBeagle record
Correct agent answers concealed incorrect persistent memory states
An agent could answer memory questions correctly while storing an incorrect underlying state, concealing future risk from answer-only benchmarks.
FEB-30 controlled benchmark with 30 evolving trajectories, 147 documents and varied memory updates. Its 16-point average divergence and 20% operation classification figures are study measurements, not production incident rates.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Impact
- Band 1 of 4
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
FEB-30 tests evolving facts across 30 trajectories and reports a divergence between latent stored state and answer accuracy, including poor update-operation classification. Results depend on benchmark document construction and tested agents. No field exploitation or deployed fix is established.
Impact basis: Stored agent memory could remain stale despite an apparently correct downstream answer in controlled trajectories. This is a benchmark-observed state-integrity problem, not a compromised deployed memory service.
Assessed Oct 19, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-FEB30-MEMORY-STATE-DIVERGENCE · FEB-30: Beyond Downstream QA for Agent Memory
At a glance
For agents that act on recalled preferences, access grants or procedures, a correct-looking response cannot certify the persisted record that will influence future actions.
Read the implicationsThirty synthetic trajectories with known ground truth are a controlled methodology, not a prevalence estimate of production user-memory corruption. They do not test deliberate malicious poisoning or actual financial effects.
Limits and uncertaintyFull account
Correct retrieval from memory does not guarantee correct memory maintenance. An agent can produce the right answer because the latest passage happens to be available, while its durable memory still contains an outdated or contradicted fact. FEB-30 measured both the internal memory state and answers to questions after a sequence of updates, rather than treating downstream question accuracy as the sole oracle.
The benchmark contains 30 evolving trajectories, including distractor documents and changes that require the system to revise or remove facts. The authors report an average gap of about sixteen percentage points between intrinsic memory correctness and downstream answers in the evaluated setup, with low accuracy in classifying needed memory operations. The outcome describes the specific systems and constructed trajectories; it is not evidence that a named production assistant corrupted a customer's records.
The operational failure becomes material when a stale memory entry is later reused as trusted context by another task. Testing therefore needs to inspect stored facts after contradictions, deletions and out-of-order updates, not just ask a few questions immediately after writing a memory. An accurate response can hide a state-management defect that surfaces only in a later authorized action.
Claims & evidence
CLM-FEB30-MEMORY-STATE-DIVERGENCEFEB-30 reports an average sixteen percentage-point gap between internal fact-state correctness and final question answering, including memory operation classification accuracy of only twenty percent in the tested system.supported
Basis: reported finding
- supportsFEB-30: Beyond Downstream QA for Agent Memoryprimary disclosure
Abstract; 6 Experiments; Findings 1 and 3
Implications
For agents that act on recalled preferences, access grants or procedures, a correct-looking response cannot certify the persisted record that will influence future actions.
Controls and mitigations
- Test both the full memory state after conflicting updates and the downstream task outcome, including superseded and retracted facts.
Unknowns and contradictions
- Thirty synthetic trajectories with known ground truth are a controlled methodology, not a prevalence estimate of production user-memory corruption. They do not test deliberate malicious poisoning or actual financial effects.
Sources and citation
Material revision history
- Oct 19, 2026 · Published version · first publication · revision 174
- Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile