Delete a bad policy from an AI agent's memory, and there's a good chance it comes back anyway.
Researchers tested five agent-memory systems, the databases that let AI agents remember facts and instructions across sessions. They loaded each system with a policy, then revoked it and swapped in a replacement. Across nine scenarios and nine different models, they checked whether the revoked policy still showed up when the agent searched memory, and whether the agent then acted on it. Under six different defense setups, every single system returned the revoked fact and let it outrank its replacement.
That's not a cosmetic bug. If revoking a security policy doesn't actually stop an agent from following it, then soft delete memory designs are quietly training agents to trust stale, contradicted instructions over current ones. The researchers built a guard that sits between the agent and its memory store and blocks anything marked revoked or in conflict with a newer record. That's effectively an admission that the underlying systems can't police themselves.
Marking something invalid and actually stopping an agent from using it, it turns out, are two very different engineering problems.