Notes, Wiki or 16 Vectors: How AI Agents Remember – and When It Backfires

What this is about

Language models forget everything the moment a conversation ends. Whatever they "know" in the next session has to be stored somewhere outside the model and fed back in at the right moment. How to build that is one of the big open questions for AI agents, programs that carry out multi-step tasks on their own.

In the first week of November, three very different answers arrived. On November 4, Notion pitched its workspace as shared memory for ChatGPT, Claude and other assistants. On November 5, Stanford (Jure Leskovec's SNAP group) publicly presented Memorilla, which squeezes entire chat histories into 16 vectors no human can read. On November 6, Anthropic published the study "The components of agent memory" on notes, wikis and what it calls "dreaming." Meanwhile, Meta is rolling out the memory feature of its Muse Wonder model to all Muse and Meta AI users.

For you as a user, all three approaches come down to the same questions: Where does the memory live? Can I read and correct it? And does it help at all? The published numbers show the answer to that last question is no more often than you'd think.

Approach 1: Anthropic – a stack of readable text files

Anthropic describes memory as a four-layer hierarchy. At the bottom are transcripts, the complete, searchable record of every session. Above them are notes that Claude writes itself while working. These feed into knowledge structures such as wikis, pages that link to one another. At the top is injected context: material that loads automatically at the start of every session. Running across all layers is dreaming. During idle periods, Claude rereads old transcripts, compares them with its notes, fixes mistakes and decides what to preload in the future. Anthropic compares this to the brain consolidating experiences during sleep.

All of it is text. You can open it, read it and change it. In Claude Code, the MEMORY.md file is a table of contents, and according to the documentation only the first 200 lines or 25 KB get loaded into each session. Anthropic itself notes that models follow instructions less reliably as these files get longer.

Approach 2: Memorilla – 16 vectors nobody can read

Memorilla comes at the problem from the other side. An encoder (Qwen3-Embedding-4B) stores each document, such as a conversation or a book chapter, once as an embedding, a string of numbers representing the text's meaning. When a question comes in, 16 trained "memory slots" read the question and the entire memory store. From that, they produce 16 vectors that are fed straight into the language model's input (Qwen3-8B). The language model itself stays unchanged. Only the memory module, with 194.1 million parameters, is trained.

The payoff is space. On NarrativeQA, full context needs 67,385 tokens per question. Memorilla needs 16. With 512 documents, it answers on an H100 in 0.74 seconds instead of 19.9. On the PersonaMem-v2 personalization test, it scores 44.6 percent. The best baseline, xRAG, manages 30.9 percent, and the full chat history 27.9 percent. All figures come from the authors themselves, and the preprint hasn't been peer-reviewed yet.

The authors are upfront about the trade-off: the fixed 16 tokens can lose exact details like names. On NarrativeQA, classic RAG (retrieval-augmented generation, which pulls out matching passages of text) wins on "Who?" and "Which?" questions. On PubMedQA, Memorilla scores 59 percent, below full context at 67 percent. Because the vectors are written directly into the model, you need open weights and a separately trained module for each language model. That rules out ChatGPT, Claude and Gemini.

Approach 3: Notion – one database for every assistant

Notion isn't building a new kind of memory. It's turning its workspace into the storage location. Via MCP (Model Context Protocol, an open standard that lets AI assistants access external tools), connected assistants save memories to a private Memories database along with a summarizing About page. According to the October 19 release notes, "Memory Sync" is live, while sharing skills (reusable work instructions) over MCP is "coming soon." The feature works on all Notion plans, but only through personal connections.

Setup creates an "Agent Operating Guide." This page defines what gets stored where and what's off-limits. Decisions with their reasoning, corrections, preferences and project status are supposed to be saved. Passwords, small talk, intermediate drafts and copied code are supposed to stay out. Retrieved content is explicitly meant to be treated as information, not as instructions.

Notion names one catch itself: connecting doesn't guarantee that every session remembers the same things. Each assistant has to call the tools on its own. Past chat histories aren't imported, and you have to paste the instruction block into each assistant yourself.

The three approaches compared

Where more memory hurts

The most revealing numbers of the week aren't about success. They're about excess.

If you write everything down, you don't get anywhere. In Pokémon Red, Sonnet 3.7 created 413 files in 225 folders by around step 10,000, totaling about 978,000 characters. It earned one badge and spent a lot of time reorganizing its notes. Fable 5 wrote 10 files with about 43,000 characters, including a central overview of goals, and earned four. Caveat: each was a single run. One Hacker News commenter called the comparison a "useless experiment" for that reason.

Weaker models barely use their memory. Here's how it looks on CL-Bench, a test of continual learning on database tasks:

According to Anthropic, Sonnet 5 reads its notes unprompted in about 9 out of 10 cases, Sonnet 4.6 in fewer than half. Only when explicitly told to did Sonnet 4.6 reach 0.641. Rigid rules like "only note mistakes" actually hurt: for Opus 5, the gain shrank by 0.234.

A wiki bigger than its sources. Given a set of ten documents (115 KB), Claude built a wiki with 68 pages, 255 links and 203 KB, 1.77 times the original. Anthropic says it "abstracted practically nothing." On the large Stainless corpus of about 350,000 files, however, the wiki did help: after 128 dreaming sessions, the hit rate rose from 13 to 48 percent, and with additional search to 61 percent instead of 53. On tasks where the answer sat in a single document, it brought no clear advantage.

Shared writing destroys knowledge. When several agents wrote to the same contracts table, they overwrote each other. Only 41 of 57 checked facts (72%) survived. With one page per contract, all 57 did. That's a notable finding for Notion's model, where multiple assistants write to the same database. Notion addresses it with a rule to update existing pages instead of creating duplicates.

False memories stick. Anthropic warns that a bad note in preloaded context ends up in every session. In the Pokémon test, a wrongly recorded location sent Claude over a one-way ledge three times. Only dreaming caught the mistake. Then there's the security risk: according to an analysis by the Cloud Security Alliance, tampered agent skills can write instructions into CLAUDE.md or AGENTS.md that persist even after the skill is removed. In February, security firm Snyk examined 3,984 skills and found 76 with confirmed malicious code.

Practitioners clean house. One Hacker News user says they've turned off automatic memory everywhere. They delete about 95 percent of what Claude Code creates, because it almost always only applies to the task at hand.

And everyday assistants?

Independent benchmarks confirm that memory is needed. According to LongMemEval, commercial chat assistants and long-context models lose about 30 percent accuracy over extended conversations. In the PersonaMem-v2 paper, frontier models only reach 37 to 48 percent at recognizing unstated preferences. An agent memory using 2,000 instead of 32,000 tokens reached 55 percent there. These figures aren't directly comparable with Memorilla's, because the task format and models differ.

In the major apps, memory is now mostly visible to you. In Claude, you'll find it under "Settings > Your Claude > Manage," where you can read, edit and delete individual topics. Important: if you delete a chat, the memories created from it stay. In Gemini, you can edit stored info under "Personal context." In ChatGPT, according to OpenAI, you can delete individual memories or reset all of them. Meta's picture is mixed. According to user guides, the Muse agent keeps an editable MEMORY.md. But Meta's help text warns that Muse may still remember things it learned even after you delete them. For Muse Wonder's "Active Memory," Meta documents neither where it's stored nor how you can view it. The improvements from 76 to 90 percent that Meta cites come from its own tests.

Analysis

The three approaches represent a genuine trade-off. Text-based memory like Anthropic's and Notion's is auditable and correctable, but easily grows to the point of uselessness. Latent memory like Memorilla is extremely compact and picks up faint connections that search misses. In exchange, nobody can look up what the model "remembers," and exact names get lost. One developer team rejected Memorilla for now in a public GitHub issue for exactly that reason: there's no way to trace which lesson a run actually used.

Our take: What matters isn't how much a system remembers, but its judgment about what's worth keeping, and whether a model reads its notes at all. Anthropic openly showing how little older models benefit and how a wiki bloats is more honest than many product announcements. Still, many comparisons rest on single runs or a single benchmark. Memorilla's results are self-reported and haven't been independently verified. With Notion, it's unclear how reliably different assistants actually use the shared database.

In practice, this means: check regularly what your assistant has stored about you, delete anything outdated, and favor systems whose memory you can read. A memory you can't inspect can also contain errors or injected instructions without you ever noticing.