When ChatGPT retrieves something it has stored about you and uses it to shape a response, the answer comes back as one continuous stretch of text. OpenAI has added a Memory Sources control: click the book icon and you can see which past chats contributed. Gemini may show a "Personalizing" indicator while it draws on earlier conversations. Both improve on memory that operates invisibly, but they operate at the level of the session, not the response.
The answer itself does not mark which of its parts came out of storage and which were worked out just now. A recommendation shaped by a conversation from three months ago, a preference lifted from a connected email account, and a conclusion reached in response to the question actually asked all arrive in the same paragraph, in the same register. OpenAI's own documentation notes that the sources panel may show selected past chats rather than everything consulted, and that the sources disappear when a conversation is shared. Google's help page suggests asking Gemini directly whether past-chat memory contributed, which asks the user to trust the system's account of its own provenance.
This matters because memory is a write path. Without it, a session is read-only in the direction that counts: whatever happens inside it stays inside it. With memory, the session also writes, into a store that later sessions will read from and act on. Anything that can reach that store can shape an answer somebody else receives weeks later. In GitHub Copilot Memory, memories attached to a repository can be generated from work started by any contributor who has write access and memory enabled, then surfaced to other people's agents. The people whose judgment sits inside the output now include some who were never in the conversation.
Session-scoped security testing cannot reach this. The OWASP 2026 Top 10 names persistent memory and cross-session propagation as prompt injection vectors; the 2025 version did not. But a taxonomy entry is not an executable test. AgentDojo, the benchmark NIST used to evaluate agent hijacking, explicitly excludes tasks repeated without resetting the agent's context, which is precisely the condition under which memory does anything at all. Microsoft's AI Red Team reports finding memory poisoning frequently in engagements with deployed systems, and no reusable scoring protocol for it.
Developer-facing infrastructure is starting to supply pieces. Cloudflare's Agent Memory API exposes an originating session ID and timestamp for each stored memory. GitHub tags repository memories with citations to the code that supports them. These are useful materials. None yet assembles what would close the gap: a record, available to the person acting on the output, tying each substantive claim in a response to the stored material behind it, the actor who contributed that material, and the conditions under which it was stored.
Until something produces that record, memory extends trust backward in time, to sessions and inputs and people the current user has no way to evaluate. The interfaces can tell you that memory was used. They cannot tell you whose judgment is in it.
- Memory poisoning demonstrated experimentally: An ACL 2026 paper showed that triggers embedded in user-uploaded images could poison an agent's persistent memory and influence later planning decisions at roughly 85% success rate in a mock e-commerce environment.
- NIST scoping agent identity: A February 2026 NIST concept paper asked for evidence on how identity standards should apply to software agents, separating identification, authorization, auditing, and non-repudiation as distinct problems.
- Red-team tooling gaps documented: A Cloud Security Alliance evaluation found that PyRIT supports multi-turn attack orchestration but identified persistent-memory manipulation and long-horizon evaluation as capability gaps in current agentic red-teaming tools.
- W3C workshop on agent commerce: A September 2026 W3C/GS1 workshop agenda separates agent identity, user delegation, and final acceptance as distinct design problems — each of which memory complicates when stored context from one actor informs another's transaction.