Feed
Discussion
That's very interesting, Roberto, We are a company based in Switzerland, and we are working on a project related to secure persistent memory for AI agents, specifically on issues such as memory poisoning, trust, and how agents decide which state to retain or invalidate between sessions.
We would like to get in touch with you, if possible. Best regards.
Really interesting concept. The point that an agent needs to remember the state of the environment, not just the conversation, really stood out to me.
In longer security research sessions, knowing what’s still running, which access is valid, and what has already been investigated seems far more valuable than simply feeding an old transcript back to the model. I also appreciate the focus on making the state structured and resumable rather than treating memory as a giant chat history.
The security side of persistent memory is an important part of this too—especially making sure sensitive state doesn’t become an unexpected source of leakage. Great read and a thought-provoking approach to building agents that can actually pick up where they left off.
Log redaction belongs before the model sees the payload. I strip secrets and PII in the tool layer so a curious prompt cannot leak them later.
The invalidation layer may be just as important as the persistence layer here. At IT Path Solutions, we’ve found that persistent agent state becomes much safer when the system can distinguish between information that was never verified and information that was verified but is no longer valid. In a changing environment, allowing an old verified state to remain trusted can be more dangerous than having no memory at all. I like the idea of tracking instance changes because it gives the system a concrete trigger for revalidation. It could be even more useful if the invalidation reason became part of the state, whether the target changed, credentials expired, a process disappeared, or the original evidence became stale. That would give the agent a much clearer basis for deciding when it can safely resume and when it needs to verify again.