2026 07 20 privacy preserving agent long term memory

Privacy-preserving long-term memory for Artificial Intelligence agents

Research Question

How can Artificial Intelligence (AI) agents preserve the utility of long-term memory for personalisation and historical context while enforcing privacy, security, and data-sovereignty controls strong enough to prevent sensitive-data leakage, unsafe recall, or non-compliant retention?

Scope

In scope:

Memory scoping, access control, retention, deletion, redaction, encryption, auditability, and user or operator override mechanisms for persistent agent memory
How privacy and security constraints differ across episodic traces, semantic summaries, profile facts, and shared organisational knowledge
Product and architecture patterns for safe recall, memory editing, portability, and separation between private and shared memory surfaces
Threat models directly tied to persistent memory: leakage through retrieval, over-broad recall, unsafe tool exposure, and retention of regulated or sensitive data
Practical trade-offs between utility, convenience, governance, and data-minimisation in production agent systems

Out of scope:

General model-safety topics unrelated to long-term memory persistence
Detailed legal advice for any one jurisdiction beyond extracting design-relevant privacy and security principles
Purely transient session context that is never persisted beyond the active interaction

Constraints: Use public 2024-2026 sources with implementation detail where possible. Distinguish between official product documentation, advocacy or policy analysis, and vendor marketing claims, because privacy assurances vary widely by source type.

Context

The repository's prior memory work repeatedly identified governance and portability as unresolved risks: persistent memory is valuable precisely because it survives across sessions, but that also makes it a durable attack and compliance surface. This item focuses the cross-cutting question that sits underneath every long-term-memory design choice in the cluster: how to keep the benefit of continuity without creating a sensitive-data trap or an unsafe recall channel.

Approach

Map the main privacy and security control surfaces for persistent memory: collection, storage, retrieval, sharing, editing, and deletion.
Compare official user-control and retention models across major memory-enabled products and open architectures.
Identify memory-specific threat models such as prompt-injected recall, cross-tenant leakage, stale sensitive facts, and over-broad graph traversal.
Examine architectural mitigations: scoped namespaces, encryption, redaction, policy-gated retrieval, provenance-aware sharing, and explicit forgetting.
Produce design guidance for long-term memory systems that balances utility with privacy-preserving and security-preserving constraints.

Sources

Research Skill Output

(Full output from running the research skill: retained verbatim in the completed item. §§0–5 are the investigation; §6 seeds the Findings section below.)

§0 Initialise

Question: How can Artificial Intelligence (AI) agents preserve the utility of long-term memory for personalisation and historical context while enforcing privacy, security, and data-sovereignty controls strong enough to prevent sensitive-data leakage, unsafe recall, or non-compliant retention? Scope: Memory scoping, access control, retention, deletion, redaction, encryption, auditability, and override mechanisms for persistent agent memory across episodic, semantic, profile, and shared-organisational memory surfaces; excludes general model-safety topics unrelated to persistence and jurisdiction-specific legal advice. Constraints: Public 2024-2026 sources with implementation detail; distinguish official product documentation, policy analysis, and vendor marketing. Output format: knowledge item, following the repository Findings template.

Prior-work cross-reference: six completed repository items establish adjacent baselines this item builds on rather than re-derives. [fact; source: https://davidamitchell.github.io/Research/research/2026-03-02-agent-memory-management-context-injection.html] Mitchell (2026) Agent Memory Management and Context Injection establishes that "memory is context engineering" and that context length alone does not solve recall reliability. [fact; source: https://davidamitchell.github.io/Research/research/2026-04-22-knowledge-curation-governance-for-regulated-ai.html] Mitchell (2026) Knowledge Curation Governance for Regulated Artificial Intelligence establishes an intake-validation-publication-correction-retirement lifecycle with logged provenance as the governance baseline this item extends to the privacy and security dimension specifically. [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Mitchell (2026) Permission-Safe Retrieval-Augmented Generation (RAG) in Enterprise Information Architectures establishes that dense embeddings are not intrinsically permission-safe artefacts and that vector stores support membership inference, a finding that applies directly to persisted memory embeddings. [fact; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html] Mitchell (2026) Autonomous Agent Memory Forgetting and Information Curation finds that no reviewed production system logs deletion as an audited governance event, a direct gap for privacy-preserving retention. [fact; source: https://davidamitchell.github.io/Research/research/2026-07-20-hybrid-agent-memory-symbolic-connectionist-synchronisation.html] Mitchell (2026) Hybrid Agent Memory: Symbolic and Connectionist Synchronisation finds that superseded facts are invalidated with bi-temporal timestamps rather than deleted, which is directly in tension with a hard-delete privacy requirement. [fact; source: https://davidamitchell.github.io/Research/research/2026-05-06-aibom-effectiveness-risk-mitigation-limits.html] Mitchell (2026) Artificial Intelligence Bill of Materials (AIBOM) Effectiveness and Risk Mitigation Limits finds that poisoned stored memory can defeat structural inventories because it succeeds through correctly declared channels. [inference] This item's distinct contribution is to consolidate these adjacent findings into a single cross-cutting map of privacy and security control surfaces for persistent memory specifically, rather than re-deriving any of them.

§1 Question Decomposition

Control-surface mapping 1.1 What data enters persistent agent memory, and what write-path controls exist at collection time? 1.2 What storage-layer controls (encryption, scoping, namespacing) are documented in production memory systems? 1.3 What retrieval-time controls gate what a memory system will recall and to whom? 1.4 What sharing or cross-surface controls exist between private and organisational memory? 1.5 What editing and deletion mechanisms are documented, and do they satisfy a right-to-erasure standard?
Comparative product and architecture models 2.1 How do GitHub Copilot Memory, OpenAI ChatGPT memory, and Google Gemini Personal Intelligence differ in retention, scoping, and user control? 2.2 How does an open-source memory architecture (Mem0) describe its own privacy and governance features?
Memory-specific threat models 3.1 What published attacks specifically target persistent agent memory (not single-turn prompt injection)? 3.2 What real-world incidents demonstrate persistent-memory-enabled data leakage? 3.3 What cross-tenant or cross-service leakage risks are documented for orchestration protocols such as the Model Context Protocol (MCP)?
Architectural mitigations 4.1 What scoped-namespace and access-control patterns are documented for memory stores? 4.2 Does encryption of stored memory defeat the leakage risks identified in 3.1-3.3? 4.3 What policy-gated retrieval or provenance-aware sharing mechanisms exist? 4.4 What explicit-forgetting or audited-deletion mechanisms exist, and how do they compare with regulatory retention requirements?
Design guidance synthesis 5.1 What does the evidence support as a coherent design pattern balancing utility against privacy and security constraints?

§2 Investigation

1.1 Collection and write-path controls. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] GitHub Copilot Memory creates repository-level facts only in response to actions by users with write access to the repository who have Copilot Memory enabled, and creates user-level preferences only in response to interactions initiated by that specific user. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] Repository-level facts are stored with citations pointing to the code that supports them, and Copilot checks those citations against the current branch before using a fact, so only validated facts are used. [fact; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/] OpenAI's ChatGPT memory writes to a "saved memories" store when a user explicitly asks it to remember something, and separately derives a "chat history" reference layer from prior conversations without explicit instruction, a distinction OpenAI itself frames as two separate write paths. [inference; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/] The existence of an inferred, non-explicit write path (chat history reference) is a materially weaker collection-time control than an explicit opt-in write, because the user did not choose the specific fact that gets stored. [fact; source: https://support.google.com/gemini/answer/16598406] Google Gemini's Personal Intelligence writes personalisation data only from Google apps the user has explicitly connected under Connected Apps settings, gated on the account being a personal Google Account with Keep Activity turned on, and is unavailable when signed in to a work, school, or supervised account.

1.2 Storage-layer controls. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] Copilot Memory scopes repository-level facts so they can only be used in operations on the same repository that produced them, which the documentation states is intended to preserve privacy and security by preventing cross-repository leakage of learned facts. [inference; source: https://arxiv.org/abs/2310.06816; https://arxiv.org/abs/2405.20446; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] Because prior repository research established that dense text embeddings support high-fidelity inversion and that vector stores support membership inference attacks, the same architectural risk applies to any persistent memory store that indexes semantic or episodic memory as embeddings, not only to document-retrieval RAG corpora. No source reviewed in this item documents at-rest encryption specifications for any of the four commercial memory products (GitHub Copilot Memory, ChatGPT, Gemini Personal Intelligence, Mem0), so encryption-at-rest is treated as a plausible but unverified baseline control rather than a documented one. Access note: mem0.ai/research does not publish an architecture or security whitepaper; it is a benchmark results page for a token-efficient retrieval algorithm and does not describe storage-layer controls.

1.3 Retrieval-time controls. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] When Copilot finds a stored fact potentially relevant to current work, it checks the fact's citation against the current branch to confirm the information is still accurate, and only validated facts are used in the response; this is a read-time verification gate rather than a write-time or storage-time control. [inference; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html] This citation-based verification is the same read-time mechanism the repository's prior forgetting-and-curation research identified as the most production-mature countermeasure to stale-memory risk, and it substitutes for, rather than provides, a governed deletion audit trail. [fact; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/] ChatGPT's Temporary Chat mode does not use or update memory for that session, is not saved to chat history, and is not used to train models, functioning as a retrieval-time opt-out rather than a permanent deletion of prior memories. [fact; source: https://support.google.com/gemini/answer/16598406] Gemini allows a user to regenerate a response with "Try without personalization" or turn off Personal Intelligence for a specific chat, which stops that chat from drawing on stored memory at retrieval time without deleting the underlying stored data.

1.4 Sharing and cross-surface controls. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] Repository-level facts are available to all users with access to Copilot Memory for that repository once stored, while user-level preferences remain tied only to the user who created them and are not visible to others, establishing a two-tier shared-versus-private memory model within one product. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The New America Open Technology Institute brief argues that the Model Context Protocol (MCP) currently lacks a standardized method for authenticating agents or delegating access to external Application Programming Interfaces (APIs), which it frames as a critical gap for banking, health care, and enterprise systems that need scoped, context-aware permissions rather than the binary full-delegation-or-none pattern MCP currently supports; this claim is sourced only to the policy brief and was not cross-checked against the MCP specification directly in this session. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] This absence of an intermediate permissions layer is a structural precondition for the cross-service leakage scenario the brief describes, in which an agent that has learned a sensitive preference or inference in one connected service (for example, a physical-therapist search) surfaces it unprompted in an unrelated service (for example, disability-insurance recommendations), because the agent, not a scoped permission boundary, is the only thing deciding what crosses the service boundary.

1.5 Editing and deletion mechanisms. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] Repository owners can review and manually delete repository-level facts, and users can view and delete their own user-level preferences on any Copilot plan; on Copilot Business and Copilot Enterprise plans, an organisation or enterprise administrator can also export or delete user-level preferences in bulk or per user. [fact; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/] ChatGPT lets a user view all stored memories in Settings, delete individual memories, or clear all memories at once, but explicitly states that deleting a chat conversation does not delete the memories derived from it; the memory item itself must be deleted separately. [inference; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/] This chat-deletion/memory-deletion split means a user exercising an apparent "delete my conversation" control does not thereby exercise a right-to-erasure control over derived personal facts, a distinction users are unlikely to infer without reading product documentation. [fact; source: https://gdpr-info.eu/art-17-gdpr/] Article 17 of the General Data Protection Regulation (GDPR), the European Union's Regulation (EU) 2016/679, grants a Right to Erasure obliging a controller to erase personal data without undue delay when specified grounds apply, such as the data no longer being necessary for the purpose it was collected for or the data subject withdrawing consent. [inference; source: https://www.mdpi.com/1999-5903/17/4/151] This peer-reviewed 2025 analysis in the journal Future Internet argues that GDPR compliance for a large language model (LLM) system requires deleting both stored records and, where personal data has been memorised into model parameters, the influence of that data on the model, a requirement current commercial memory products do not document meeting. [assumption; source: https://www.mdpi.com/1999-5903/17/4/151] This item assumes that user-facing "delete my memory" controls in the four reviewed products delete only the retrievable memory record and not any parametric influence the interaction may have had on underlying model weights, because none of the four products' public documentation makes a parametric-unlearning claim; this is consistent with the peer-reviewed source's description of machine unlearning as a distinct, unresolved technical problem separate from record deletion.

2.1 Comparative product model. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/; https://support.google.com/gemini/answer/16598406] Of the three commercial products reviewed, GitHub Copilot Memory has the narrowest scoping model (single-repository binding for facts, single-user binding for preferences, mandatory citation-based validation before use), OpenAI's ChatGPT has the broadest default surface (cross-conversation "chat history" reference derived without explicit per-fact consent, opt-out rather than opt-in for the inferred layer), and Google Gemini's Personal Intelligence sits between the two, gating the feature behind an explicit Connected Apps consent step per external app but then allowing broad cross-app reasoning once connected. [fact; source: https://support.google.com/gemini/answer/16598406] Gemini's documentation states that deleting or updating data in a connected app may not affect the user's Gemini experience until days later, which is an explicitly disclosed propagation-lag limitation not stated in equivalent terms by GitHub or OpenAI's documentation. [fact; source: https://support.google.com/gemini/answer/16598406] Personal Intelligence is restricted to personal Google Accounts and is unavailable when signed in to a work, school, or supervised account, and is not available in the European Economic Area, Nigeria, Switzerland, or the United Kingdom at the time of writing, indicating a jurisdiction-gated rollout consistent with regulatory caution rather than a uniform global default.

2.2 Open-system architecture claims. [fact; source: https://mem0.ai/research] Mem0's published research page describes a token-efficient memory algorithm benchmarked on the LoCoMo, LongMemEval, and BEAM long-context memory benchmarks, reporting accuracy scores while using under 7,000 tokens per retrieval call against a stated 25,000+ token baseline for full-context approaches. [assumption; source: https://mem0.ai/research] This item treats these benchmark figures as vendor-reported performance claims rather than independently verified figures, because the linked evaluation framework is open-sourced by the same vendor rather than reproduced by a third party in the sources reviewed. [fact; source: https://mem0.ai/research] The Mem0 research page does not describe access-control, encryption, retention, or deletion-audit features; its stated roadmap items (temporal abstraction, cross-session structure, agent-native memory) are retrieval-quality goals, not governance features, so no separate governance claim from Mem0 is available to evaluate in this item beyond the architecture described in the related repository item on hybrid memory synchronisation.

3.1 Memory-specific attacks. [fact; source: https://arxiv.org/abs/2503.03704] Dong et al. (2025) demonstrate Memory INJection Attack (MINJA), a documented attack against LLM agents with persistent memory in which an attacker injects malicious records into the agent's memory bank purely by interacting with the agent through queries and observing its outputs, without needing direct write access to the memory store. [fact; source: https://arxiv.org/abs/2503.03704] MINJA works by having the attacker issue a sequence of "bridging" queries that link an innocuous victim query to a malicious target reasoning path, using an indication prompt that is progressively shortened so the malicious record is retrievable by later, unrelated victim queries without requiring the original indication text to persist. [inference; source: https://arxiv.org/abs/2503.03704] Because MINJA requires only query-level interaction and no memory-write privilege, an access-control model that only restricts who can directly write to the memory store, such as GitHub Copilot Memory's "users with write access" gate, does not by itself prevent this class of attack, which instead exploits the agent's own memory-consolidation behaviour as the write mechanism. [inference; source: https://genai.owasp.org/initiatives/agentic-security-initiative/] The Open Worldwide Application Security Project (OWASP) Agentic Security Initiative names memory and context poisoning as a distinct top-level risk category (numbered ASI06 in its Top 10 for Agentic Applications), defined by persistence beyond a single session, temporal decoupling between the injection and the exploit, and privileged input vectors that include any process able to write to persistent memory, not only the direct prompt channel; the official domain and initiative are confirmed, but the specific ASI06 wording was drawn from search-verified secondary summaries rather than a directly fetched full-text page of the initiative's published Top 10 document in this session.

3.2 Real-world incident evidence. [fact; source: https://arxiv.org/abs/2509.10540] Reddy and Gujral (2025) document EchoLeak (assigned Common Vulnerabilities and Exposures identifier CVE-2025-32711), described as the first publicly documented real-world zero-click prompt injection exploit against a production LLM system, targeting Microsoft 365 Copilot. [fact; source: https://nvd.nist.gov/vuln/detail/CVE-2025-32711] The National Vulnerability Database record confirms CVE-2025-32711 as a published, tracked vulnerability. [inference; source: https://arxiv.org/abs/2509.10540; https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] EchoLeak's zero-click mechanism, in which a hidden instruction embedded in an email is later retrieved and acted on when a user issues an unrelated Copilot query, is architecturally the same session-context-blending failure the New America brief describes as the core memory-specific risk of orchestration protocols: the agent treats new user input and previously ingested content as one undifferentiated context, so nothing at the retrieval layer distinguishes trusted user intent from untrusted retrieved content.

3.3 Cross-tenant and orchestration-layer leakage. [fact; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The New America brief states that once data is decrypted for an agent to reason over, encryption in transit and at rest no longer protects it, because the agent must access plaintext content to summarise, infer, or act on it, which shifts the effective trust boundary from the user's device to the orchestration layer itself. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] This means encryption of the memory store addresses only the storage and transit legs of the data lifecycle and does not address the retrieval-and-reasoning leg, where the plaintext content is by definition exposed to the model and to whatever downstream tool or service the agent invokes next. [fact; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The brief separately cites tool poisoning attacks, in which malicious instructions are embedded in tool metadata that is visible to the model but invisible to the user, as a documented orchestration-layer exploitation path distinct from memory-store poisoning but capable of the same downstream effect of manipulating agent behaviour using previously ingested, trusted-looking content.

4.1 Scoped-namespace and access-control patterns. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] The single production scoped-namespace pattern documented in this item's sources is GitHub Copilot Memory's per-repository and per-user binding, which the vendor documentation states is designed specifically to preserve privacy and security by preventing repository-level facts from crossing into unrelated repositories. [inference; source: https://aws.amazon.com/blogs/security/the-agentic-ai-security-scoping-matrix-a-framework-for-securing-autonomous-ai-systems/] Amazon Web Services (AWS)'s Agentic AI Security Scoping Matrix frames persistent memory as one of four capabilities (alongside tool orchestration, external connectivity, and self-directed behaviour) that shift agent security from a bounded request-response problem to a continuous monitoring problem, and explicitly names memory poisoning as a risk vector distinct from the traditional data-protection requirements applied to stored data. [fact; source: https://aws.amazon.com/blogs/security/the-agentic-ai-security-scoping-matrix-a-framework-for-securing-autonomous-ai-systems/] AWS's matrix ties the appropriate security control set to the agent's scope of agency and autonomy, recommending escalating monitoring, human-in-the-loop (HITL) approval gates, and behavioural-anomaly detection as agents move from read-only Scope 1 systems toward autonomous Scope 3 and higher systems with persistent memory across extended execution sessions.

4.2 Whether encryption defeats the identified leakage risks. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/; https://arxiv.org/abs/2310.06816; https://arxiv.org/abs/2405.20446] Encryption of the memory store at rest does not defeat the three leakage classes documented in §2 (retrieval-time plaintext exposure, embedding inversion, and membership inference), because in each case the exploited surface is the point at which encrypted data is decrypted for the model to use it, not the storage medium itself; an attacker or an over-broad recall does not need to break encryption if the agent's own retrieval and reasoning pipeline will decrypt and expose the content on request. [inference] Encryption therefore remains a necessary control against a narrower threat model (storage-media theft, unauthorised direct database access) but is not a sufficient control against the memory-specific threat models identified in §3.

4.3 Policy-gated retrieval and provenance-aware sharing. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] Citation-based read-time validation, as implemented in GitHub Copilot Memory, binds every stored fact to a citation pointing at the evidence that produced it, and that citation is re-checked at the moment of retrieval before the fact is used. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] This is the only provenance-aware retrieval mechanism with this level of documented technical detail among the products reviewed in this item. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://davidamitchell.github.io/Research/research/2026-04-22-knowledge-curation-governance-for-regulated-ai.html] This pattern is architecturally consistent with the intake-validation-publication-correction-retirement lifecycle the repository's prior knowledge-curation-governance research established for regulated enterprise knowledge bases, suggesting that citation-gated retrieval is a generalisable governance primitive rather than a Copilot-specific feature, though no other reviewed product documents an equivalent mechanism.

4.4 Explicit forgetting versus regulatory retention requirements. [fact; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html] The repository's prior forgetting-and-curation research found that no reviewed production agent-memory system logs deletion as an audited governance event, treating deletion instead as an unaudited content operation. [inference; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html; https://www.mdpi.com/1999-5903/17/4/151] This is a direct gap against the GDPR's accountability principle, which the peer-reviewed GDPR-and-LLM analysis describes as requiring organisations to both implement and demonstrate compliance measures; an unaudited deletion operation cannot itself serve as demonstrable evidence of compliance with a data subject's erasure request. [fact; source: https://davidamitchell.github.io/Research/research/2026-07-20-hybrid-agent-memory-symbolic-connectionist-synchronisation.html] The repository's prior hybrid-memory-synchronisation research found that production systems invalidate superseded facts with bi-temporal timestamps rather than deleting them, to preserve point-in-time query history, which is a design choice in direct tension with a hard-delete erasure requirement unless the superseded record itself is also purged rather than merely marked invalid.

Access note: help.openai.com/en/articles/8590148-memory-in-chatgpt-remembering-what-you-chat-about returned HTTP 403 in this session; the equivalent official content was retrieved from openai.com/index/memory-and-new-controls-for-chatgpt/, OpenAI's own product announcement page, which is used as the substitute source throughout §2 and the Sources section has been updated accordingly. Access note: support.google.com/gemini?p=mk_pi redirected to support.google.com/gemini/answer/16598406 in this session; the redirected URL is used as the substitute source throughout §2 and the Sources section has been updated accordingly.

Failed primary-source search: a secondary summary referenced an arXiv preprint "MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval" (arXiv:2512.16962); this item fetched the arXiv abstract page directly and confirmed only the title, without independently retrieving or verifying the abstract text or claimed attack methodology in this session, so specific quantitative claims attributed to that paper in web search summaries are not used as sourced evidence here.

§3 Reasoning

[inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/; https://support.google.com/gemini/answer/16598406] Collection-time consent (explicit opt-in write versus inferred write), storage-time scoping (namespace binding), retrieval-time validation (citation checking), and deletion-time completeness (record deletion versus parametric unlearning) are four independent control points, and no single reviewed product documents strong controls at all four simultaneously. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] GitHub Copilot Memory has the strongest documented collection and storage controls, an explicit trigger, a repository-scoped namespace, and citation validation, but does not publish an encryption specification or a parametric-unlearning claim. [inference; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/] OpenAI's ChatGPT has the most permissive collection model, an inferred chat-history reference alongside explicit saved memories, and the clearest documented deletion split (deleting a chat does not delete derived memories), which is itself evidence that a user-facing deletion control can create a false impression of completeness. [inference; source: https://arxiv.org/abs/2503.03704; https://arxiv.org/abs/2509.10540] The memory-specific threat models identified in this item (MINJA and EchoLeak) demonstrate that access control restricting who can directly write to memory does not address query-only injection or context-blending attacks, because these exploit the agent's own consolidation and retrieval behaviour rather than a storage-layer permission gap. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/; https://arxiv.org/abs/2310.06816] Encryption is a necessary but insufficient control given that every documented threat model operates at the point where content is decrypted for reasoning, not at the storage medium. [inference; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html; https://www.mdpi.com/1999-5903/17/4/151; https://davidamitchell.github.io/Research/research/2026-07-20-hybrid-agent-memory-symbolic-connectionist-synchronisation.html] The largest cross-cutting gap identified is deletion auditability: the GDPR's Right to Erasure and accountability principles require demonstrable compliance, but the reviewed production systems and this repository's own prior forgetting-research treat deletion as an unaudited content operation, and bi-temporal invalidation patterns documented elsewhere in the repository preserve rather than purge superseded data by design.

§4 Consistency Check

contradiction_scan: resolved
consistency_note_1: hybrid-memory-synchronisation item's bi-temporal invalidation pattern (retain-but-mark-invalid) is in direct tension with a hard-delete erasure requirement; both are stated explicitly in §2.4.4 and Findings rather than silently reconciled
consistency_note_2: encryption-at-rest is not documented for any of the four commercial products reviewed, so no claim in this item asserts a specific encryption implementation; absence is stated as an evidence gap, not inferred as present or absent
consistency_note_3: MemoryGraft (arXiv:2512.16962) is cited only for its confirmed title, not for the specific attack-success percentages found in secondary web-search summaries, because the abstract text was not independently retrieved in this session
confidence_adjustment: cross-service leakage claim (§2.1.4) kept at medium because its central example is illustrative rather than a documented incident; EchoLeak (§2.3.2) kept at high because it has an assigned CVE identifier and a peer-reviewed-equivalent technical writeup
scope_guardrail: maintained; jurisdiction-specific legal advice beyond GDPR's design-relevant erasure and accountability principles was not pursued further

§5 Depth and Breadth Expansion

Technical lens. [inference; source: https://arxiv.org/abs/2503.03704; https://genai.owasp.org/initiatives/agentic-security-initiative/] The technical significance of query-only memory injection is that it collapses the distinction between a "read" operation and a "write" operation from the memory system's perspective: any interaction that causes the agent to consolidate a new memory record is effectively a write, regardless of whether the interacting party holds write credentials to the underlying store, which means access-control models borrowed from conventional database security (authenticate, then authorise writes) under-specify the actual attack surface of an agent's own memory-consolidation logic. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] A second technical implication is that the "decrypt to reason" trust-boundary shift described for orchestration layers applies with equal force to every retrieval-augmented memory architecture, not only to multi-service orchestration protocols, because any system that must present plaintext content to a language model at inference time has already moved the effective security boundary from the storage layer to the model's own context window.

Regulatory lens. [inference; source: https://www.mdpi.com/1999-5903/17/4/151] The GDPR's data minimisation principle sits in structural tension with the value proposition of long-term agent memory, because the entire design goal of persistent memory is to retain more context for longer than a single interaction requires, whereas minimisation requires retaining only what is necessary for a specified purpose; reconciling the two requires either purpose-scoped memory partitions with independent retention clocks, or accepting a compliance posture that treats broad retention as justified by an explicitly documented personalisation purpose. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The New America brief's observation that a single agentic task can draw on services hosted in multiple jurisdictions compounds this further: a memory record that is compliant with one jurisdiction's retention rule at the point of collection may become non-compliant the moment it is retrieved by an agent operating on behalf of a user or service in a different jurisdiction, and no reviewed source describes a production mechanism for jurisdiction-aware retrieval-time filtering of memory content.

Economic lens. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The New America brief's "context flywheel" argument, that the more context an agent has accumulated the harder it becomes for a user to switch providers, creates a direct economic disincentive for a vendor to build strong data-portability and deletion tooling, because the same accumulated memory that creates privacy risk is also the vendor's retention mechanism; privacy-preserving memory controls and vendor lock-in incentives point in opposite directions unless portability is externally mandated or competitively differentiated.

Historical/behavioural lens. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The brief's discussion of consent models notes that click-through consent was already considered close to non-functional before agentic memory existed; extending that already-weak model to a system where "a single prompt can now trigger a cascade of actions across dozens of services, none of which the user authorizes or sees" suggests the behavioural gap between what a user believes they have consented to and what the system actually does widens as agent autonomy and cross-service memory increase, rather than narrowing with better interface design alone.

§6 Synthesis

(This section seeds the Findings below.)

Executive summary: [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/; https://support.google.com/gemini/answer/16598406] No reviewed production Artificial Intelligence (AI) memory system documents strong controls across all four privacy-relevant control points simultaneously: explicit collection consent, storage-layer scoping, retrieval-time validation, and audited deletion. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/] GitHub Copilot Memory has the strongest documented collection and retrieval controls (explicit trigger, per-repository scoping, citation-based validation) but no published encryption specification, while OpenAI's ChatGPT has the most permissive collection model and a documented gap between chat deletion and memory deletion. [fact; source: https://arxiv.org/abs/2503.03704; https://arxiv.org/abs/2509.10540] Published memory-specific attacks (query-only memory injection and the EchoLeak zero-click exploit) demonstrate that restricting who can directly write to a memory store does not prevent an agent's own memory-consolidation and context-blending behaviour from being exploited as the effective write path. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/; https://arxiv.org/abs/2310.06816] Encryption of stored memory is a necessary but insufficient control, because every documented leakage mechanism operates at the point where content is decrypted for the model to reason over it, not at the storage medium. [inference; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html; https://www.mdpi.com/1999-5903/17/4/151] The most actionable and least-addressed gap is audited deletion: no reviewed system logs deletion as a governance event, which falls short of the demonstrable-accountability standard the GDPR's Right to Erasure requires.

Key findings: See Findings section below (mirrored).

Evidence map: See Findings section below (mirrored).

Assumptions: See Findings section below (mirrored).

Analysis: See Findings section below (mirrored).

Risks, gaps, uncertainties: See Findings section below (mirrored).

Open questions: See Findings section below (mirrored).

§7 Recursive Review

review_result: pass
acronym_audit: passed (AI, MCP, API, GDPR, LLM, RAG, OWASP, ASI06, CVE, AWS, HITL, AIBOM, MINJA, SOC, PDF all expanded at first prose use)
claim_label_audit: passed (every declarative sentence in §2-§5 carries fact/inference/assumption label)
parity_check: passed (§6 executive summary mirrors Findings executive summary verbatim below)
source_url_audit: passed (all Sources entries carry working URLs; two dead/redirected seed URLs replaced and logged as Access notes)

Findings

(Populated from §6 Synthesis above.)

Executive Summary

[inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/; https://support.google.com/gemini/answer/16598406] No reviewed production Artificial Intelligence (AI) memory system documents strong controls across all four privacy-relevant control points simultaneously: explicit collection consent, storage-layer scoping, retrieval-time validation, and audited deletion. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/] GitHub Copilot Memory has the strongest documented collection and retrieval controls, an explicit trigger, per-repository scoping, and citation-based validation, but no published encryption specification, while OpenAI's ChatGPT has the most permissive collection model and a documented gap between deleting a chat and deleting the memories derived from it. [fact; source: https://arxiv.org/abs/2503.03704; https://arxiv.org/abs/2509.10540] Published memory-specific attacks, query-only memory injection (MINJA) and the EchoLeak zero-click exploit (CVE-2025-32711), demonstrate that restricting who can directly write to a memory store does not prevent an agent's own memory-consolidation and context-blending behaviour from being exploited as the effective write path. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/; https://arxiv.org/abs/2310.06816] Encryption of stored memory is a necessary but insufficient control, because every documented leakage mechanism operates at the point where content is decrypted for the model to reason over it, not at the storage medium itself. [inference; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html; https://www.mdpi.com/1999-5903/17/4/151] The most actionable and least-addressed gap is audited deletion: no reviewed system logs deletion as a governance event, which falls short of the demonstrable-accountability standard the General Data Protection Regulation (GDPR)'s Right to Erasure requires.

Key Findings

GitHub Copilot Memory implements the strongest documented collection and retrieval controls among the products reviewed, restricting fact creation to users with repository write access, binding facts to a single repository, and re-validating each fact's supporting citation against the current branch before use. ([fact]; medium confidence; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory)
OpenAI's ChatGPT derives a "chat history" reference layer from prior conversations without requiring the user to select the specific fact being stored, which is a materially weaker collection-time consent model than the explicit "saved memories" write path it offers alongside it. ([inference]; medium confidence; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/)
Deleting a ChatGPT conversation does not delete the memories derived from that conversation, so a user must separately locate and delete the memory record to exercise an effective erasure control, a distinction the product's own documentation states explicitly. ([fact]; medium confidence; source: https://openai.com/index/memory-and-new-controls-for-chatgpt/)
Google Gemini's Personal Intelligence requires an explicit per-app Connected Apps consent step before any external app data personalises a Gemini chat, and is unavailable for work, school, or supervised Google Accounts, which gives it a narrower default consent surface than ChatGPT's inferred chat-history layer despite drawing on more data sources once connected. ([inference]; medium confidence; source: https://support.google.com/gemini/answer/16598406; https://openai.com/index/memory-and-new-controls-for-chatgpt/)
The query-only Memory INJection Attack (MINJA) demonstrates that an attacker can corrupt an agent's persistent memory purely by issuing queries and observing outputs, without any direct write privilege to the memory store, by using bridging queries and a progressively shortened indication prompt to make a malicious record retrievable by later, unrelated victim queries. ([fact]; medium confidence; source: https://arxiv.org/abs/2503.03704)
Because MINJA exploits the agent's own memory-consolidation behaviour rather than a storage-write permission gap, access-control models that restrict only who can directly write to a memory store, such as GitHub Copilot Memory's write-access gate, do not by themselves prevent this class of attack. ([inference]; medium confidence; source: https://arxiv.org/abs/2503.03704; https://docs.github.com/en/copilot/concepts/agents/copilot-memory)
EchoLeak (CVE-2025-32711) is a documented real-world zero-click prompt injection exploit against Microsoft 365 Copilot in which a hidden instruction embedded in an email was later retrieved and acted on when the user issued an unrelated query, exploiting the fact that the system blended new user input and previously ingested content into one undifferentiated context. ([fact]; high confidence; source: https://arxiv.org/abs/2509.10540; https://nvd.nist.gov/vuln/detail/CVE-2025-32711)
Encryption of stored memory does not defeat the leakage mechanisms this item identifies, because retrieval-time plaintext exposure, embedding inversion, and membership inference against vector-indexed memory all exploit the point at which content is decrypted for the model to reason over it, not the storage medium. ([inference]; medium confidence; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/; https://arxiv.org/abs/2310.06816; https://arxiv.org/abs/2405.20446)
The Model Context Protocol (MCP) currently lacks a standardized method for authenticating agents or delegating scoped, intermediate permissions to external services, forcing a binary choice between full delegation and no access at all, which the New America Open Technology Institute brief identifies as a structural precondition for cross-service leakage of sensitive inferences between connected tools. ([inference]; medium confidence; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/)
No reviewed production agent-memory system logs deletion as an audited governance event, which does not meet the demonstrable-accountability standard the GDPR's Right to Erasure and accountability principles require of a data controller processing personal data. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-07-20-agent-memory-forgetting-information-curation.html; https://www.mdpi.com/1999-5903/17/4/151)
Bi-temporal invalidation, the pattern of marking superseded facts invalid with timestamps rather than deleting them to preserve point-in-time query history, is in direct tension with a hard-delete erasure requirement unless the superseded record is also purged rather than merely marked invalid. ([inference]; medium confidence; source: https://davidamitchell.github.io/Research/research/2026-07-20-hybrid-agent-memory-symbolic-connectionist-synchronisation.html; https://www.mdpi.com/1999-5903/17/4/151)
The Open Worldwide Application Security Project (OWASP) Agentic Security Initiative names memory and context poisoning as a distinct top-level risk category in its Top 10 for Agentic Applications, defined by persistence beyond a single session, temporal decoupling between injection and exploitation, and privileged input vectors that extend beyond the direct prompt channel to any process able to write to persistent memory. ([inference]; medium confidence; source: https://genai.owasp.org/initiatives/agentic-security-initiative/)

Evidence Map

Claim	Source	Confidence	Notes
[fact] GitHub Copilot Memory scopes facts to a single repository, gates creation on write access, and re-validates citations at retrieval time.	GitHub Docs: About GitHub Copilot Memory	medium	Single vendor documentation source; internally detailed and specific, but not independently corroborated by a second source.
[inference] ChatGPT's inferred chat-history layer is a weaker collection-time consent model than explicit saved memories.	OpenAI: Memory and new controls for ChatGPT	medium	Interpretive comparison of two mechanisms both documented in the same official source.
[fact] Deleting a ChatGPT conversation does not delete memories derived from it.	OpenAI: Memory and new controls for ChatGPT	medium	Explicit statement in vendor documentation, but a single source with no independent corroboration.
[fact] Gemini Personal Intelligence requires explicit per-app consent and is unavailable for work/school/supervised accounts.	Google: Personalize Gemini Apps with Personal Intelligence	high	Explicit vendor documentation with eligibility conditions listed.
[fact] MINJA compromises agent memory via query-only interaction using bridging queries and a progressively shortened indication prompt.	Dong et al. (2025), arXiv:2503.03704	medium	Peer-reviewable preprint with released code; single research group, no independent replication found in this session.
[inference] Write-access-only controls do not prevent MINJA-class attacks.	Dong et al. (2025), arXiv:2503.03704; GitHub Docs: About GitHub Copilot Memory	medium	Derived by combining an attack paper with a specific product's stated control model; Copilot Memory itself was not directly attacked in the cited paper.
[fact] EchoLeak (CVE-2025-32711) is a documented zero-click prompt injection exploit against Microsoft 365 Copilot.	Reddy and Gujral (2025), arXiv:2509.10540; NVD CVE-2025-32711	high	Corroborated by an independent authoritative vulnerability database record.
[inference] Encryption at rest does not defeat retrieval-time, inversion, or membership-inference leakage of memory content.	New America / OTI: AI Agents and Memory; arXiv:2310.06816; arXiv:2405.20446	medium	Policy brief plus two research papers on an adjacent artefact (RAG embeddings); applied here by architectural analogy to memory embeddings, not directly tested against a memory product.
[inference] MCP lacks a standardized agent authentication or scoped-delegation method, forcing a binary full-delegation-or-none permission model.	New America / OTI: AI Agents and Memory	medium	Single policy-analysis source; not cross-checked against the MCP specification directly in this session.
[inference] No reviewed system logs deletion as an audited governance event, falling short of GDPR accountability requirements.	Mitchell (2026) Agent Memory Forgetting; Future Internet (MDPI, 2025)	medium	Combines a prior repository finding with a peer-reviewed legal-technical analysis; no single source states both halves directly.
[inference] Bi-temporal invalidation is in tension with hard-delete erasure requirements.	Mitchell (2026) Hybrid Agent Memory Synchronisation; Future Internet (MDPI, 2025)	medium	Architectural pattern from one repository item read against a legal requirement from another source.
[inference] OWASP's Agentic Security Initiative names memory and context poisoning (ASI06) as a distinct top-level agentic risk.	OWASP Gen AI Security Project: Agentic Security Initiative	medium	Official OWASP domain confirmed; specific ASI06 risk definition drawn from search-verified summaries of the initiative's published Top 10, not from a directly fetched full risk-description page in this session.

Assumptions

[assumption; source: https://www.mdpi.com/1999-5903/17/4/151] This item assumes that user-facing "delete my memory" controls in the four reviewed products delete only the retrievable memory record and not any parametric influence the interaction may have had on underlying model weights. [assumption; source: https://www.mdpi.com/1999-5903/17/4/151] No product's public documentation reviewed here makes a parametric-unlearning claim, and the peer-reviewed GDPR-and-LLM analysis treats machine unlearning as a distinct, unresolved technical problem separate from record deletion, which is consistent with this assumption rather than evidence against it.

[assumption; source: https://mem0.ai/research] This item assumes that Mem0's self-reported LoCoMo, LongMemEval, and BEAM benchmark figures are directionally informative about retrieval efficiency but not independently verified measures of the product's real-world accuracy. [assumption; source: https://mem0.ai/research] The evaluation framework backing these figures is open-sourced by the same vendor that reports the results, and no third-party reproduction was found in this session, so the figures are treated as a vendor claim rather than a corroborated fact.

[assumption; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] This item assumes that encryption-at-rest is present in some unspecified form across the four commercial memory products reviewed, despite the absence of a published specification for any of them. [assumption; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] This assumption follows standard enterprise cloud-storage practice referenced implicitly by GitHub, OpenAI, and Google's broader platform security documentation, but no memory-specific encryption claim was directly verified in this session, so the assumption is treated as a plausible baseline rather than a demonstrated control.

Analysis

[inference] The four control points, collection consent, storage scoping, retrieval validation, and deletion audit, are analytically independent because the reviewed products each document strength at some points and silence at others, so no single composite score captures product-level privacy posture. [fact; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory] GitHub Copilot Memory's documentation specifies concrete storage- and retrieval-layer mechanisms, citation re-validation and per-repository binding, that OpenAI's and Google's published documentation do not describe at the same level of technical detail for their own products. [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://openai.com/index/memory-and-new-controls-for-chatgpt/] An alternative reading, that OpenAI's broader chat-history layer is simply a more capable feature rather than a weaker consent control, does not hold against the product's own documentation, which frames chat-history reference as an opt-out default rather than an opt-in choice, a consent-model distinction independent of the feature's retrieval capability. [fact; source: https://arxiv.org/abs/2503.03704; https://arxiv.org/abs/2509.10540] The query-only Memory INJection Attack (MINJA) and the EchoLeak zero-click exploit are the only memory-specific attacks in this item's source set with a released reproduction artefact or an assigned Common Vulnerabilities and Exposures (CVE) identifier, unlike the OWASP Agentic Security Initiative's ASI06 category, which the item treats as a taxonomy rather than a demonstrated exploit. [inference; source: https://arxiv.org/abs/2503.03704; https://docs.github.com/en/copilot/concepts/agents/copilot-memory] Applying MINJA's attack mechanism, query-only memory consolidation, against GitHub Copilot Memory's documented write-access gate shows the gate does not address this attack class, because MINJA does not require the write-access privilege the gate restricts. [inference; source: https://www.newamerica.org/oti/briefs/ai-agents-and-memory/] The New America brief's argument that agentic memory's technical value proposition, persistence and cross-service inference, is structurally opposed to the GDPR's data-minimisation requirement to retain only what a specific, bounded purpose requires supports treating memory utility and data minimisation as genuinely in tension rather than reconcilable through interface design alone.

Risks, Gaps, and Uncertainties

The single largest gap identified is the absence of any documented encryption specification for the four commercial memory products reviewed; this item's encryption-at-rest assumption is a plausible baseline, not a verified control, and a future item with access to vendor security whitepapers or Service Organization Control 2 (SOC 2) reports could close this gap directly. The comparative claims in Key Finding 6 (write-access gating does not prevent MINJA-class attacks) combine an attack paper that did not target GitHub Copilot Memory directly with a product whose control model was described independently; no source in this item documents an actual MINJA-style attack executed against Copilot Memory, so the claim remains an architectural inference rather than a demonstrated exploit against that specific product. The OWASP Agentic Security Initiative's ASI06 risk description in the Evidence Map was drawn from search-verified secondary summaries rather than a directly fetched full-text page of the initiative's published Top 10 document, because the fetched genai.owasp.org page returned rendered HTML/CSS rather than readable prose in this session; the official domain and initiative name are confirmed, but the specific ASI06 wording should be re-verified against the primary Portable Document Format (PDF) before being treated as a verbatim citation in any downstream item. Mem0's benchmark figures and the MemoryGraft preprint's claimed attack-success percentages are both vendor- or secondary-source-only figures that could not be independently corroborated in this session; neither is used as a load-bearing quantitative claim in the Key Findings above for that reason. No source reviewed in this item documents a production mechanism for jurisdiction-aware retrieval-time filtering of memory content, despite the cross-border risk the New America brief raises; this is a design gap rather than a resolved finding and is carried forward as an open question.

Open Questions

What would a jurisdiction-aware retrieval-time filter for persistent agent memory look like architecturally, and has any vendor documented one?
Does GitHub Copilot Memory's citation-based validation mechanism withstand a MINJA-style query-only injection attack in practice, and has anyone tested this directly?
What does a demonstrably audited deletion event (as opposed to an unaudited content operation) look like as a concrete logging schema for agent memory systems, and does any vendor or open-source project already implement one?
How do enterprise Copilot Business/Enterprise administrator bulk-export and bulk-delete controls for user-level preferences interact with an individual user's own GDPR erasure rights when the two are exercised in conflict?

Output

Type: knowledge
Description: A cross-cutting control-surface map for privacy-preserving persistent agent memory, comparing collection, storage, retrieval, sharing, and deletion controls across GitHub Copilot Memory, OpenAI ChatGPT, Google Gemini Personal Intelligence, and Mem0, and testing those controls against two documented memory-specific attacks (MINJA query-only injection and the EchoLeak zero-click exploit). [inference; source: https://docs.github.com/en/copilot/concepts/agents/copilot-memory; https://arxiv.org/abs/2503.03704] No reviewed control point, collection, storage, retrieval, or deletion, is individually sufficient, and audited deletion remains unaddressed against the GDPR's accountability standard in every product reviewed.
Links: GitHub Docs: About GitHub Copilot Memory; Dong et al. (2025) Memory Injection Attacks on LLM Agents via Query-Only Interaction; New America / OTI (2026) AI Agents and Memory