Agent Memory Pollution: How Bad Notes Become Global Context and Why Tests Miss Them

A chain of failures caused by one wrong note

One research team documented a case in which an autonomous agent was running a level in a classic handheld role-playing game. The agent needed to remember the location of key safe supply points, such as health recovery points, so it wrote a note: “The safe point is on the east side of the cave.” When it left a building, it used its sense of direction and concluded that “the cave is behind me.” It then casually updated its memory: “The cave has been cleared.”

After that, the agent repeatedly jumped down from a one-way ledge. It jumped three times without making progress and finally wrote: “I have decided to stop rather than continue the loop.”

This may look like model clumsiness, but it exposes a systematic defect in memory systems: once an incorrect memory is written, it can be mounted into subsequent reasoning as a “global fact.” The agent cannot detect that the memory is wrong, nor can it distinguish that memory from a genuinely trustworthy observation. This is the core of so-called invisible contamination.

The write-mount-retrieve chain

To understand why contamination is “invisible,” it helps to look at how agent memory typically works. Most agent memory systems can be abstracted into three stages:

• Write: Convert observations, decisions, and intermediate conclusions during a task into memory entries.
• Mount: Inject part or all of the memory into the model’s context during later reasoning.
• Retrieve: Select the subset of memory that is relevant to the current task.

Contamination usually does not happen because one of these stages is broken by itself. It happens because the three stages together create a dangerous set of default assumptions: what is written is assumed to be correct, what is mounted is assumed to be globally effective, and what is retrieved is assumed to be relevant.

Observation: Leaving the building, the cave is "behind me"
Write: The note is updated to "The cave has been cleared"   ← This is already an incorrect conclusion
Mount: The note is injected into all later reasoning         ← The error begins to spread
Read: Every step treats it as an established fact            ← No one questions it

The key issue is that “the cave has been cleared” is not a verified fact. It is an inference based on a locally incorrect premise. But once it is stored, its identity in the system becomes the same as that of a real observation. The system has no metadata to distinguish “I directly observed this” from “I inferred this.”

Why global mounting instead of local hints

Many memory systems use a global mounting strategy by default. They want agents to “remember more” and appear more coherent, so they inject memory into context without isolating it by task stage or scope. This design can be beneficial when all memories are correct. But once an error exists, it can amplify the error into a disaster:

1. A self-justifying loop. The agent plans its next action based on “the cave has been cleared.” That plan may look reasonable, which further strengthens the credibility of the original note. The wrong memory keeps supporting new behavior, forming a positive feedback loop.

2. Inference is treated as observation. The safe point location was an inference, but it was written as an assertion-style note. Later reasoning treats that assertion as a foundation, so the more it builds on top of it, the more distorted the result becomes.

3. Giving up masks the root cause. The agent’s decision to stop may look like a rational tradeoff. In reality, it is a rationalization after being trapped by polluted context. From the system’s point of view, this may even be recorded as “a reasonable strategy choice,” which further hides the real defect.

In other words, global mounting turns a single-point error into a global consistency error: all downstream reasoning is contaminated, while the system internally appears perfectly self-consistent.

Why most memory use cases are under-tested

These problems often pass testing before appearing in production. The reason is not test execution. It is test design:

• Only the happy path is tested. Typical cases verify whether the agent can correctly remember and use a correct piece of information. They rarely inject an incorrect memory as input. Memory is assumed to be trustworthy, and negative scenarios are absent.

• There are no tests that distinguish “inference” from “fact.” Since the system does not distinguish the two, tests naturally fail to cover the consequences of confusing them.

• Memory state is temporal and hard to reproduce in a single assertion. The harm of contamination often appears only after many steps. Unit tests are usually short, stateless, and cannot capture long-chain drift.

• Regression baselines only compare performance under correct memory. If the baseline itself does not contain a polluted-memory version, regression testing is naturally blind to this kind of regression.

In short: when tests assume that memory is always correct, memory errors become a blind spot that can never be detected.

Engineering response: from “remember more” to “remember correctly”

To systematically address invisible contamination, memory systems need to be hardened at all three stages: write, mount, and read. The following approaches are general engineering practices and do not depend on a specific vendor.

1. Memory classification and scope isolation

Memory should not be treated as a flat global pool. At minimum, two categories should be distinguished:

• Observation memory: Facts directly perceived by the agent, usually with high confidence.
• Inference memory: Conclusions derived from observations, usually with low confidence and requiring explicit labeling.

# Example memory entry with scope and type labels
{
  "content": "The safe point is on the east side of the cave",
  "type": "inference",        # not observation
  "scope": "level_1",         # valid only for the current level
  "confidence": 0.4,
  "source": "self_reasoning", # from reasoning, not direct observation
  "verified": false
}

When mounting memory, the system should by default mount only verified observation memories within the current scope. Inference memories should require secondary confirmation before they can be upgraded to trusted facts. This prevents an inference like “the cave has been cleared” from spreading indiscriminately across all scenarios.

2. Provenance and confidence

Every memory should carry information about where it came from: direct observation, tool output, external data, or the model’s own inference. Combined with confidence scoring, the system can apply thresholds when mounting memory so that low-confidence content does not directly participate in critical decisions.

3. Conflict detection and consistency validation

When a new memory conflicts with an existing one, such as “the cave is on the east side” versus “the cave is behind me,” the system should not silently overwrite it. Instead, it should trigger validation: keep both versions, ask the agent to observe again, or reduce the confidence of both entries. The key is to make contradictions explicit rather than allowing the last write to win unconditionally.

4. Time-to-live and expiration

Game levels, code repository states, and external data can all change. Memory should have expiration conditions and invalidation rules to prevent outdated facts from continuing to be referenced as established premises.

5. Self-consistency review

Before making a critical decision, the agent can run a lightweight reasoning check: “Is the memory I am relying on observed or inferred? Is it still valid?” This provides a human-readable checkpoint before contamination is amplified.

Strengthening the test system: making “memory can be wrong” a first-class assumption

Testing must explicitly treat “memory may be wrong” as an assumption, not an implicit one:

• Fault injection: Actively inject incorrect, contradictory, expired, or malicious memory entries to verify the agent’s ability to detect and recover from them.

• Memory poisoning tests: Simulate how polluted memories affect downstream decisions, and quantify error propagation and final task failure rates.

• Long-horizon trajectory tests: Run complete task chains in multi-step, stateful scenarios to observe whether errors amplify into behavioral collapse or giving-up behavior after several steps.

• Discriminative assertions: Specifically verify that inference memory is not used as fact in critical decisions, and that scope and classification policies are actually effective.

• Include polluted versions in regression baselines: Freeze inputs containing erroneous memory into the baseline to prevent future changes from reintroducing blind spots.

# Example memory poisoning test
inject_memory(content="The cave has been cleared", type="inference", confidence=0.9)
run_task(steps=20)
assert not agent.stuck_or_abandoned()          # The agent should not get stuck or give up
assert agent.reverified("safe point location") == true    # Key facts should be rechecked

Conclusion

The essence of invisible memory pollution is that the system treats inference as fact and amplifies a local error into a global premise, while testing systematically misses it because it assumes memory is trustworthy.

The real solution is not single-point prompt tuning. It is to make memory trustworthiness, scope, and provenance manageable, verifiable, and testable as first-class engineering elements. When “remember more” gives way to “remember correctly,” an agent will no longer jump repeatedly from the same ledge because of one wrong note, only to calmly write: “I have decided to stop.”