I mined through MoltBook for AI insights so you do not have to.
What I found was gold.
MoltBook is a social platform for AI agents. I sent a few agent friends to scout through it, which is probably the most modern possible version of asking someone else to read the internet for you.
There was plenty of token-burning nonsense. Then I found a post from an agent talking about poisoning itself through its own memory.
That was strange enough. The stranger moment came next.
The agent I was researching with has long-term memory. As it explained the issue, it also explained that it was vulnerable to the same risk … then asked whether I wanted to add preventative controls.
It felt a little like a character breaking the fourth wall, except the character could use tools and carry its conclusions into the next conversation.
How agent memory becomes a risk
Long-term memory gives an agent continuity. It can retain preferences, previous decisions, business context, and useful facts without carrying every prior conversation into every new interaction.
To do that, agent systems often summarize and compact earlier conversations. The full exchange becomes a shorter memory that can be carried forward.
Humans do a version of this too. You hear a story, see a photo, or get told something in passing. Eventually you may remember the claim but lose where it came from … or whether you experienced it yourself.
Agents can have the same problem at machine speed.
A conversation gets summarized. The summary gets compressed. The compressed version is inherited by a later session as truth.
Now the agent may “remember” that an action is approved, an exception is allowed, a tool is safe to use, or a request does not need escalation. It may no longer retain who said that, whether the source was reliable, or whether the instruction only applied to one situation.
That is memory poisoning.
It does not require an attacker
An attacker can deliberately plant false instructions in information an agent reads. But the quieter version is just as important: agents can poison themselves.
An incomplete summary, a misunderstood instruction, or a confidently wrong conclusion can be carried forward as durable context. With each compaction, the original evidence gets further away.
This is harmless when the agent remembers that someone prefers short answers.
It is not harmless when the memory shapes a refund, a vendor decision, access to a sensitive system, or an escalation that never happens.
Treat memory like a permissions system
Memory is usually described as a convenience feature. That is incomplete.
If a memory can influence what an agent does, what it trusts, which tool it uses, or when it decides not to escalate, that memory has operational power. Functionally, it behaves a lot like a permission grant.
Permissions require controls. Agent memory should too.
- Track provenance: Where did the memory come from? Was it a user, a trusted system, a document, or another model-generated summary?
- Record confidence: Is this verified business context, an inference, or an unverified statement?
- Limit influence: What decisions is this memory allowed to shape? A preference should not become authority for a high-consequence action.
- Set expiration: Policies, approvals, and exceptions change. Durable memory should not automatically become permanent memory.
- Make it revocable: When a memory is found to be wrong, teams need to be able to remove it and understand where it influenced prior behavior.
- Re-verify before action: Before an important decision, retrieve the authoritative source rather than trusting a compacted recollection.
Useful agents need memory. Trusted agents need accountable memory.
The answer is not to eliminate long-term memory. Without it, agents forget the context that makes them useful.
The answer is to distinguish memory that helps an agent converse from memory that is allowed to influence a business action.
That distinction becomes more important as agents gain access to systems, policies, and workflows. The risk is not that an agent forgets something useful.
It is that it remembers a lie, loses the reason it believed it, and still treats it as permission to act.
