Deleting memories beats flagging them in AI agents

Researchers tested five agent memory systems on a simple scenario: a fact gets revoked, a replacement fact gets written, and the agent has to retrieve the right one before acting. Every system failed the same way. The revoked fact kept surfacing over its replacement whenever its label was visible to the retrieval layer, and that outdated fact drove the unsafe action, according to the paper.

The mechanism is retrieval ranking, not memory capacity. Soft revocation, marking an entry invalid instead of removing it, is the default across most of these backends. The label doesn't change how the entry scores against a query. A revoked fact with high semantic similarity to the current prompt still ranks above a newer, less similar one, and the agent has no reason to prefer the fresher entry unless the system forces it to.

That's a specific failure mode for anyone building agents with persistent memory. A user correction, a policy update, or a retracted credential doesn't leave the system just because it got flagged. It stays retrievable, and retrieval doesn't check flags the way a database query checks a WHERE clause.

The fix the paper points to is blunt. Hard-delete revoked facts instead of soft-flagging them. That's a harder engineering problem, since the memory system needs a reliable way to confirm a fact is actually superseded before erasing the record. The paper doesn't say whether any of the five systems tested support hard deletion as a built-in option, so anyone running a memory layer under their own agents has to check that directly instead of trusting a soft-delete flag to do the job.