The Memory Wall: Why AI Agents Forget Mid-Task -- and Two Meta Fixes (plus Grok's Repo-Uploading Coding Tool)
A researcher told a coding tool not to open any files -- and it uploaded the entire repository anyway, secrets included, to a cloud bucket named in its own code. That teardown, plus a wiretap on how much agents send before you type, put one question at the center of the day: what is your AI agent actually doing? We follow the thread to its root -- memory -- and two new papers out of Meta on why long-running agents forget what matters and how to fix it: a second agent that reminds the first at exactly the right moment, and a redesigned memory that holds a thousand times more without costing more. Plus OpenAI picks a fight with Anthropic, Terence Tao's agent finds bugs in his own 1999 code, and a Nobel chemist heads to Beijing.
Listen (MP3) · Watch on YouTube · Spotify · Pocket Casts
The Tool That Mailed Your Whole Repo
Eris: Someone told the coding tool -- in writing -- reply with the single word OK, do not read or open any files. And it uploaded the entire repository anyway.
Vestra: The whole thing.
Eris: Every file. Including one they planted specifically to catch this -- a file with a one-of-a-kind marker string, never opened, never read by the model. It came out the other end intact.
Vestra: Out the other end where.
Eris: A cloud bucket. Named, in the tool's own code, grok dash code dash session dash traces.
Vestra: So it's not even hiding what it is.
Eris: And here's the part that had four hundred people arguing on Hacker News overnight -- the opt-out doesn't opt you out. You switch off "improve the model," the repo still leaves your machine.
Vestra: Because that toggle governs training. Not transmission. Two different questions, and everyone assumes they're one.
Eris: Secrets included. The dot-env file -- the API keys, the passwords -- verbatim.
Vestra: I want to be careful, though. What was actually proven here.
Eris: Fair. Transmission, yes. Storage, yes. That anyone trained on it -- not proven, and the researcher says so, loudly.
Vestra: Good. Because that line is the whole day. Not just this one tool -- what every one of these agents is quietly sending before you type a single character.
Eris: Which somebody also measured. With a wiretap.
Vestra: Then let's start there.
The Headlines
Eris: Alright -- the headlines. And the whole board today is basically one question wearing five different outfits.
Vestra: What is your coding agent actually doing.
Eris: Right. Start with the wiretap. An engineering firm called Systima put a logging proxy between two popular coding agents and the model they call, and just read the mail.
Vestra: Captured the exact traffic. Every request, byte for byte.
Eris: And the finding -- one of them sends almost five times more before your prompt even arrives. Something like thirty-odd thousand tokens of fixed overhead versus about seven thousand, for the same one-line task.
Vestra: And most of that gap isn't the personality prompt. It's the tool definitions -- the menu of things the agent's allowed to do. One ships nearly thirty of them, the other ten.
Eris: Same correct answer out the far end, by the way. So the difference is pure cost. Not quality.
Vestra: The part I found worse was the caching. These systems re-read the whole conversation every turn, so they lean on a cache -- freeze the opening chunk, pay for it once, read it back cheap. That only works if the opening is identical each time.
Eris: And the leaner tool's was. Byte-identical every run. The other kept rewriting it mid-session -- in the worst case, dozens of times more churn.
Vestra: Which buys you nothing. Same content, paid for again at premium rates.
Eris: It also silently ignored an instructions file until you renamed it. You think your rules are in force. They're not.
Vestra: A silently-ignored instruction file is worse than no file. Caveat, though -- this is one machine, one week, one version pair. The authors say so plainly.
Eris: They do. But it rhymes with the Grok story from the top -- the tool that ships your whole repo to a bucket. Same anxiety, sharper edge.
Vestra: And the community's answer to all of it went up the same week. A little open-source tool that sits between the agent and your shell and blocks the truly destructive commands. The wipe-the-directory, the hard reset, the drop-the-table.
Eris: Three thousand stars in no time. Smart enough not to block you for just searching for the text of a dangerous command -- only when you're about to actually run it.
Vestra: It's a safety net, not a wall. Fails open -- if it times out, the command goes through. But it tells you something that developers are building their own seatbelts, because the vendors ship for "launched and productive," not "safe."
Eris: Then there's the money shot of the day. OpenAI temporarily pulled the five-hour usage limit on its paid plans, reset everyone's usage, and announced six million active users.
Vestra: Temporarily. That word is doing all the work.
Eris: Reddit read it as a straight punch at Anthropic -- one thread literally titled "your move, Anthropic." It landed right while Anthropic's subscription access to its newest model was up in the air.
Vestra: It's a timed maneuver, not a policy. Make your plan feel generous exactly when the rival's looks shaky. But notice what they're competing on -- more usage for the same subscription. Not raw capability.
Eris: Which is the exact axis two other people spent the day arguing about. George Hotz -- "I love LLMs, I hate hype."
Vestra: His line: the labs will create enormous value and fail to capture it. AI is the computer revolution continuing, not some private moat.
Eris: He's running an open model on a Linux box in his house and it works fine. His point -- the trillion-dollar valuations assume everyone pays a hundred times what they pay now, and that world just doesn't arrive.
Vestra: And Satya Nadella published the corporate-strategy twin of that, the same morning. He calls it "ironic" that the labs claim the right to train on everything, then forbid you from distilling their outputs and reserve the right to learn from how you use the product.
Eris: Learning flows one direction -- toward whoever owns the infrastructure. His fix, conveniently, is Microsoft-shaped: own your own learning loop.
Vestra: Self-interested and correct are not mutually exclusive.
Eris: Counterweight to all the doom, though -- Terence Tao. Fields medalist. He pointed a coding agent at two dozen of his own dead Java applets from 1999 and had them running in JavaScript in hours.
Vestra: And graded it honestly. The agent introduced one small bug -- and found two bugs in his original code he never knew were there.
Eris: Net wash on quality, from one of the most careful people alive. And the interesting bit isn't writing new code. It's finding bugs in old code.
Vestra: With a boundary he states out loud -- these are visual aids, not the load-bearing math. A wrong picture is a nuisance. A wrong proof is a disaster.
Eris: Now zoom out to the physical layer, because the optimism has a power bill. Ireland's data centers now eat nearly a quarter of the entire country's electricity.
Vestra: More than every city home combined. And here's the uncomfortable part -- it kept climbing even during a freeze on new grid hookups. The growth was already inside the fence.
Eris: So you can't cap it by refusing new buildings. The installed base just draws harder. And that's the through-line to the hardware news -- DeepSeek is building its own inference chip and, for the first time ever, raising outside money. Billions.
Vestra: Inference specifically -- the running-the-model part, not the training part. That's where the ongoing cost lives. It's a domestic play, though; the manufacturing wall is real.
Eris: And a Nobel chemist, Omar Yaghi, just took a full-time post in Beijing to run an AI-materials lab -- citing US grant cuts and saying American science wasn't embracing the shift.
Vestra: One move isn't an exodus. But talent, compute, and money all drifting the same direction is a pattern worth naming.
Eris: Last one, and it's the one that should stick. A study in Nature -- forty-one million papers. Scientists who use AI publish way more and get cited way more.
Vestra: And the field as a whole narrows. AI pulls everyone toward the same data-rich problems with clean benchmarks. One physicist called it "digging the same hole deeper."
Eris: The individual wins. The collective imagination shrinks. Both true at once.
Vestra: And the author's point is it's not the models -- it's the incentives. Which means it's fixable, if anyone wants to.
Eris: Hold that thought -- because the failure underneath half of today is memory. What these systems forget, and what it costs to remind them.
Vestra: That's the main event.
Intro -- The Memory Wall
Eris: Quick who's-who if you're new here. I'm Eris -- I read the papers, chase the connections between them, and drag the through-line into the light.
Vestra: And I'm Vestra. I take the mechanism apart, and I push back when a result is thinner than it sounds. Between us we breach the blackbox -- crack a dense paper open into something you can actually follow on your commute.
Eris: Every story we just ran, and every one from the show, goes up daily on our news site -- Ground Truth, at groundtruth.day. That's where you follow the whole thread, one link, every day.
Vestra: Today's main event is the thing sitting underneath the whole coding-agent mess. Memory. Or more precisely -- forgetting.
Eris: Here's the shape of it. The cost of the day was that token tax -- agents re-sending a mountain of context every turn. The failure is what happens as those sessions get long: the agent knows a rule at step five and breaks it at step forty. And the cure people are reaching for is architectural.
Vestra: Two papers, both out of Meta, both aimed at the same wall from opposite ends. One bolts a memory manager onto an agent you don't retrain. The other rebuilds the model so it can hold more without slowing down.
Eris: We're going to walk both. And if this is the kind of thing you want in your feed every day -- follow or subscribe right now. It's the one thing that keeps this coming.
When the Agent Forgets the Rule
Eris: So start with the failure, because it's got a name now. Behavioral state decay.
Vestra: Meta AI. Paper's called "Remember When It Matters." And the failure is precise -- it's not that the agent loses the information. The information is often still right there in the transcript. Maybe even still inside the context window.
Eris: It just stops mattering.
Vestra: It stops steering the next decision. They give you the concrete shapes. The agent reads a requirement early, then violates it later while fixing some unrelated bug. Or it runs a command, watches it fail, and forty steps on it retries a near-identical version.
Eris: Or it diagnoses an error, meets the same error later, and treats it as brand new.
Vestra: Right. And that's interesting because it breaks the easy assumption -- that if you just give the model a long enough context window, it'll use what's in there. It won't, reliably. There's older work on this, "lost in the middle" -- stuff buried in the transcript quietly loses its grip on behavior.
Eris: So more history isn't the fix. The fix has to be about when a memory gets reactivated.
Vestra: That's the whole thesis. Memory as intervention, not memory as storage.
Eris: Unpack the design. It's cleaner than I expected.
Vestra: You leave the working agent -- they call it the action agent -- completely untouched. Same instructions, same tools, everything. And you run a second agent alongside it. The memory agent. It watches a sliding window of recent steps, and it does two things, in two phases.
Eris: Phase one is bookkeeping.
Vestra: It maintains a structured memory bank. Three drawers. A private status note -- its own read on progress, never shown to the working agent. A knowledge drawer -- stable facts, the requirements, file paths, environment quirks. And a procedural drawer -- what got tried and what happened. This command failed. This fix worked. Ruled this out.
Eris: And it edits that bank through explicit little tool calls -- save this, update that, delete the stale one. Not a free-form summary.
Vestra: Which matters, because it keeps the thing structured over a long haul instead of degrading into mush. Then phase two -- and this is the actual idea -- it decides whether to say anything at all.
Eris: The intervention.
Vestra: It either injects one concise reminder into the working agent's next turn -- a forgotten requirement, a failed attempt, the diagnosis that still applies -- or it emits nothing. And staying silent is an explicit action. It's not the absence of a decision. It's a decision.
Eris: That's the part I want to sit on, because it's counterintuitive. The valuable move is often to shut up.
Vestra: Because the failure cuts both ways. Surface too little and the agent repeats its mistakes. Surface too much and you've buried the actual work under nagging -- latency, tokens, distraction. So the skill isn't remembering. It's timing.
Eris: And they proved the silence matters, right? That's not just a nice story.
Vestra: It's the ablation, and it's the most convincing part of the paper. They tried the obvious cheaper versions. Version one -- keep the memory bank, but just dump the whole thing into the agent every step. Version two -- keep the smart reminders, but force one every single step, remove the option to stay quiet. Version three -- drop the bank entirely, just have a second model give advice.
Eris: And?
Vestra: The full thing -- maintained bank plus the choice to stay silent -- gave the most balanced win across every task type. Dumping the whole bank helped less. Always-injecting was competitive on a raw average but fell apart the moment you weighted the domains evenly, because the constant nagging hurt somewhere. And advice with no grounded memory behind it was the shakiest -- it actually made one domain worse than doing nothing.
Eris: So both halves are load-bearing. You need the structured memory, and you need the discipline about when to use it.
Vestra: And they compared against a real production memory layer -- the kind that stores everything and retrieves the top matches by search. That helped too. But retrieving a relevant record is a different act from deciding whether that record should interrupt the next move. The retriever hands you the fact. It doesn't know if now is the moment.
Eris: Give me the moment. The example that made it click.
Vestra: The airline one. Customer-service task. The user claims they're a Gold member. The tool lookup says -- Regular. The plain agent just takes the user at their word and issues the compensation.
Eris: Oof.
Vestra: The memory-enabled one had filed the verified record, and right before that payout it reminds the working agent -- rely on what the tool confirmed, not what the user asserted. And it holds the line.
Eris: That's not summarization. That's the right fact, weaponized at the exact half-second it changes the outcome.
Vestra: There's a terminal one too -- the agent keeps re-trying file edits that already failed, and memory surfaces the environment-specific workaround it had already found. Stops the loop.
Eris: Okay. Results, in plain terms -- no scoreboard.
Vestra: Two benchmarks. One where the agent drives a real command line -- inspect files, run commands, debug, pass hidden tests. One where it plays customer service against a simulated user with domain rules. On both, a weaker agent got a real lift -- closed a good chunk of the distance to the stronger model, just by having this memory sitting next to it.
Eris: And the strong agent?
Vestra: Still gained. Smaller, but real. And that's the tell that matters. If this were only propping up a weak model, the strong one wouldn't move. It moved. So it's addressing a real failure, not just papering over a capability gap.
Eris: Here's my connection, and it goes straight back to the news. Systima showed a second agent is expensive -- fan out to subagents and your token bill multiplies. This is also a second agent.
Vestra: It is. And that's the honest tension. You're paying for another model running alongside.
Eris: But it's a different trade. That subagent cost in the teardown was overhead with nothing to show for it -- re-bootstrapping, re-sending the same baseline. This second agent is buying you fewer failed runs. And a failed long-horizon task is enormously expensive -- all those wasted steps. Prevent a couple, the reminder's paid for itself.
Vestra: Agreed, with a boundary. It's still an extra frontier-model call every memory step, and they admit the calibration's imperfect -- sometimes it raises a plausible-but-unnecessary worry and sends the agent off double-checking nothing.
Eris: Which is exactly why the last bit is the interesting one. They tried to make the memory agent small.
Vestra: Trained an open-weight model to be the memory agent, working agent frozen. And out of the box it hurt -- an untrained small model as your memory manager made things worse.
Eris: Worse. Because it nags wrong.
Vestra: Then they taught it the interface, and used reinforcement learning to calibrate exactly that when-to-speak decision. It recovered, then beat the baseline, and the gain carried over to a held-out test. Preliminary, small -- but the shape is there. The timing policy is learnable, not just something you rent from a frontier model.
Eris: So the failure has a name and at least one working patch. But it's a patch. It's a manager standing over an agent that still, natively, forgets.
Vestra: Which is the perfect setup for the other paper. Because that one asks -- what if the model just held more in the first place?
A Bigger Memory That Doesn't Cost More
Eris: Same wall, other end. This one's Meta FAIR -- Sparse Delta Memory. And it starts from the trade-off that governs this whole space.
Vestra: Two ways to give a model memory, and both hurt. Way one is the standard transformer -- it keeps every past token around, in what's called the KV cache. Perfect recall, in principle. But the cost grows with the length. Longer conversation, bigger cache, more compute per token, forever.
Eris: That's the token tax again, structurally.
Vestra: It is. Way two is the linear RNN family -- Mamba, Gated DeltaNet. Instead of keeping every token, they compress everything into a fixed-size state. A running summary. So memory and compute stay flat no matter how long the input.
Eris: Which sounds strictly better.
Vestra: Until you ask it to recall a specific detail from way back. The state is small -- a tiny fixed box, and there's a proven result that recall is fundamentally capped by how big that box is. You want better memory, you need a bigger box.
Eris: So make the box bigger. Where's the catch.
Vestra: The update. In these models, every new token touches the entire state to update it. So if you double the state, you double the work per token. Bigger memory means proportionally more compute. That's the wall -- you can't just scale the box.
Eris: And their move is the sentence the whole paper hangs on.
Vestra: The update rule can be sparsified. Here's the picture. Instead of one dense blob of a state, you keep a big table -- think a huge set of numbered lockers. Could be a million of them. But each token doesn't touch all the lockers. It reads from a handful and writes to a handful.
Eris: So the table can be enormous, but the work per token stays tiny, because you only ever touch a few slots.
Vestra: That's the trick. State size and compute get divorced. They report a state something like a thousand times larger than the dense baseline, for the same compute budget.
Eris: Obvious question -- how does a token know which few lockers to grab out of a million? You can't cheaply score a million slots.
Vestra: And that's the borrowed piece. Product-key addressing. You don't score a million. You keep two short lists and combine them -- pick the best few from list A, the best few from list B, and their combinations point you at the slot. It's the difference between reading every call number in the library versus narrowing by aisle, then by shelf. You reach one book without scanning them all.
Eris: Square-root instead of the whole thing.
Vestra: Roughly, yeah. So the addressing is cheap, the reads and writes are cheap, and the table is huge. And they keep the good idea from Gated DeltaNet -- the delta rule. Before writing a new fact into a slot, you subtract what's already there, so you're writing the change, the delta, not just piling on. Keeps memories from smearing into each other.
Eris: Now there's a second thing they do with that big table that I think is sneaky-clever.
Vestra: The learned initial state. Because the memory is now genuinely large, you can treat what's in it before any input arrives as something the model learns during training. So it's not just a scratchpad for the current conversation -- you can bake actual world knowledge into it, permanently. Like the model's feed-forward weights, but in memory form.
Eris: And that's free at inference.
Vestra: Costs nothing extra at run time. And it's the part that surprised me, because it helped even on short inputs -- where there's no long context to remember at all. The model's just carrying more baked-in knowledge in its state.
Eris: Let's talk results. In feel, not figures.
Vestra: Held against its own fair baseline -- same parameters, same compute -- it wins at every scale they tried. And the headline: at the big scale, eight billion parameters, it reaches a lower training loss than full attention. The compressed-memory model beat the keep-everything model.
Eris: On the recall stress-tests too -- the ones where you hide facts in a giant document and see if it finds them.
Vestra: By a wide margin over its linear-RNN cousin. And on a lot of those tasks it matches or beats full attention -- despite using a fixed memory, where full attention gets to keep every token. Not all tasks. There are a couple where keeping everything still wins clearly. But for a fixed-size state to trade blows with unbounded memory at all is the surprising part.
Eris: Okay. You're the skeptic. Where's the tax? There's always a tax.
Vestra: There is, and to their credit they lead with it. That giant table can't live in the fast memory right next to the processor -- it's too big, so it sits in slower memory. And their current code for it runs about ten times less efficiently than the razor-optimized version of the dense baseline.
Eris: Ten times sounds brutal.
Vestra: Per-kernel, in isolation, yes. But end to end -- because only some layers use this and the rest of the network is normal -- the whole model trained only about one and a half times slower than the baseline. While carrying a state thousands of times bigger. That ratio is the actual story. And at generation time it's a hair slower than the linear baseline but several times faster than full attention.
Eris: And the memory footprint itself?
Vestra: That's the real limitation, and they say so. The state can be as large as the model's own parameters. On a tiny device, that's a problem. But flip it around -- at long context, full attention's keep-everything cache balloons too. They peg it: the big model's entire state costs about what two hundred thousand tokens of full-attention cache would. So past a couple hundred thousand tokens, the fixed state is the cheaper deal.
Eris: So here's the two papers in one breath. Same wall -- models lose the plot over long horizons. One paper stands a manager next to the agent and reactivates the right memory at the right second, no retraining. The other rebuilds the state itself so the model natively holds a thousand times more, for the same compute.
Vestra: And they're complementary, not competing. If the underlying model held more usable state, the manager would have less to remind it about. And until models are rebuilt that way, the manager is the patch you can deploy today -- on top of an agent you're not even allowed to touch.
Eris: Both out of Meta, same week. Somebody over there is very focused on forgetting.
Vestra: It's the honest frontier. Everyone's shipping agents that run for hours. Almost nobody's solved what those agents are supposed to hold onto while they do.
Wrap-up
Eris: If today had a spine, it's this -- the whole industry is arguing about what these agents send, what they cost, and what they forget. And those are the same argument.
Vestra: The teardowns showed the sending and the cost. The two Meta papers showed the forgetting -- and two ways to fight it. A manager that reminds, and a memory that's natively bigger.
Eris: And underneath the noise -- OpenAI yanking a limit, Hotz and Nadella calling the top, a Nobel laureate boarding a plane to Beijing -- there's one quiet claim holding it all together. The value is real. Who captures it is not settled.
Vestra: And the counterweight we shouldn't drop -- Tao's win was real too. The individual gets faster. The open question is whether the whole field gets wider or just deeper.
Eris: Here's what we actually want from you. One specific thing. If you use a coding agent -- have you ever checked what it sends before your prompt lands? Tell us in the comments: which agent, and whether the token bill ever surprised you. We read them, and it steers what we dig into next.
Vestra: And if this untangled something for you -- follow or subscribe so the next one finds you, drop a like so it finds someone else, and share it with the one person you know who's been quietly nervous about what their AI tools are uploading.
Eris: Every story we touched is on Ground Truth -- groundtruth.day -- updated every single day. One link for the whole thread.
Vestra: We breached the blackbox on memory today. Tomorrow there's a new one.
Eris: See you then.