Case · DiggingBeagle record

Correct agent answers concealed incorrect persistent memory states

An agent could answer memory questions correctly while storing an incorrect underlying state, concealing future risk from answer-only benchmarks.

Scope

FEB-30 controlled benchmark with 30 evolving trajectories, 147 documents and varied memory updates. Its 16-point average divergence and 20% operation classification figures are study measurements, not production incident rates.

Assessment profile

Assessment method
Setting
evaluation
Exploitation
demonstrated
Impact
Band 1 of 4
Evidence
Grade B
Remediation
not applicable
AI role
AGAINST AI
Basis and provenance

FEB-30 tests evolving facts across 30 trajectories and reports a divergence between latent stored state and answer accuracy, including poor update-operation classification. Results depend on benchmark document construction and tested agents. No field exploitation or deployed fix is established.

Impact basis: Stored agent memory could remain stale despite an apparently correct downstream answer in controlled trajectories. This is a benchmark-observed state-integrity problem, not a compromised deployed memory service.

Assessed Oct 19, 2026 using diggingbeagle.assessment/1.

At a glance

Claims & evidence

CLM-FEB30-MEMORY-STATE-DIVERGENCEFEB-30 reports an average sixteen percentage-point gap between internal fact-state correctness and final question answering, including memory operation classification accuracy of only twenty percent in the tested system.supported

Basis: reported finding

Link to claim

Implications

For agents that act on recalled preferences, access grants or procedures, a correct-looking response cannot certify the persisted record that will influence future actions.

Controls and mitigations

  • Test both the full memory state after conflicting updates and the downstream task outcome, including superseded and retracted facts.

Unknowns and contradictions

  • Thirty synthetic trajectories with known ground truth are a controlled methodology, not a prevalence estimate of production user-memory corruption. They do not test deliberate malicious poisoning or actual financial effects.

Sources and citation

Material revision history

  1. Oct 19, 2026 · Published version · first publication · revision 174
  2. Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile