Operational category
Memory
What the agent remembers.
Conversational Memory
The running message history the agent reads each turn.
Recent conversation turns are retained and replayed so the model has context for the next turn — as a full transcript, a fixed-size window of the last N turns, or a running summary once the raw history outgrows the budget. This is the short-term tier of agent memory.
Trade-off Improved conversational context is achieved against higher token costs, privacy risks, and context window exhaustion.
Episodic Memory
Past tasks, persisted, so the agent can recognize its own déjà vu.
Completed interactions are stored as discrete, timestamped episodes — a natural-language memory stream — and retrieved later by a combined recency, importance, and relevance score, so the agent can reuse what worked in a similar past situation.
Trade-off Experience-based adaptation is gained against high curation and data privacy maintenance efforts.
Semantic / Vector / Graph Memory
What the agent knows, indexed for retrieval.
Long-term knowledge is stored structurally, as embeddings, or as entities and relations, independently of single conversations. Match the store to the access pattern and start simple: vector DBs for similarity recall, key-value (Redis) for fast exact lookup, relational for structured/auditable querying, and graph DBs only once vector-plus-relational becomes the bottleneck.
Trade-off Reusable, highly structured knowledge is achieved against significant updating, modeling, and ranking challenges.
Working Memory / Scratchpad
Per-task notes the agent keeps while it reasons.
A temporary working state holds intermediate steps, variables, and open tasks during a single execution run.
Trade-off Better control during a single run is gained against the need for additional state management logic.
Virtual Context Management
The agent as its own memory manager: page facts in and out like an OS.
The agent treats its finite context window like RAM and an external store like disk, and pages information between the tiers under its own control — deciding what stays resident, what is evicted to long-term storage, and what is recalled on demand — so it can operate over histories far larger than the window.
Trade-off Effectively unbounded memory under a fixed window is gained against extra inference calls to manage the paging and the risk of evicting something the agent later needs.
Recorder
Snapshot the state so the run can be resumed, not restarted.
The system state (including reasoning and world model) is explicitly captured and externalized so a run can be recovered, resumed, or replayed across steps, sessions, and processes — not only after an abort.
Trade-off Increased resilience and resumability are gained against higher storage costs and persistence overhead.
Skill Build
Turn winning trajectories into named, reusable procedures.
The agent distils successful action sequences into reusable, named skills — often executable code — and stores them in a growing skill library it retrieves and composes on future tasks, instead of re-planning from scratch. This is procedural memory.
Trade-off Continuous performance improvement is gained against the risk of overfitting or catastrophic forgetting of older skills.
The data layer
What memory owes the data it holds
An agent's memory is a data store, and OWASP's GenAI Data Security Risks 2026 name its failure modes. Eight of the twenty-one land on the patterns on this page. Each row links the patterns that carry the defense and the threat that names the same failure from the attacker's side.
| Data-layer risk | Guarded by | Related threat |
|---|---|---|
| DSGAI01Sensitive Data LeakageA retrieval store returns sensitive strings verbatim, and what a model or adapter memorized stays extractable after the source is deleted. | Semantic / Vector / Graph Memory, Least Privilege Agent | LLM02 Sensitive Information Disclosure |
| DSGAI04Data, Model & Artifact PoisoningWhat an ingestion pipeline accepts becomes what the system believes; a poisoned document stays wrong until provenance is checked independently. | Integrator, Statistical Guardrails | T1 Memory Poisoning |
| DSGAI11Cross-Context & Multi-User Conversation BleedSession state, caches, or a shared index leak one user's conversation into another's — isolation is a data boundary, not a UI one. | Conversational Memory, Least Privilege Agent | LLM02 Sensitive Information Disclosure |
| DSGAI13Vector Store Platform Data SecurityThe store itself is the target: permissive APIs, unencrypted embeddings, long-lived credentials, multi-tenant namespace confusion. | Semantic / Vector / Graph Memory | LLM09 Vector and Embedding Weaknesses |
| DSGAI14Excessive Telemetry & Monitoring LeakageTracing an agent captures whole prompts, tool calls and retrieved chunks, so the observability stack becomes a second copy of memory. | Recorder, Audit Trail | LLM02 Sensitive Information Disclosure |
| DSGAI15Over-Broad Context Windows & Prompt Over-SharingPacking the context with full records sends data to providers, caches and logs that never needed to leave the core system. | Virtual Context Management, Working Memory / Scratchpad | LLM08 Hidden Context Exposure |
| DSGAI17Data Availability & Resilience FailuresWhen the retrieval layer degrades, the failure is not an error page but silent misinformation — answers stay confident while their ground truth is stale. | Semantic / Vector / Graph Memory, Checkpointing | T5 Cascading Hallucination Attacks |
| DSGAI18Inference & Data ReconstructionRepeated queries infer whether a record was in the store and reconstruct content from embeddings or scores; caching and reuse amplify it. | Semantic / Vector / Graph Memory | LLM09 Vector and Embedding Weaknesses |
Where to next