The case for agents that die every night
Persistent agent memory turns one poisoned document into future authority. A nightly reset helps only when durable memories cross a separate, auditable promotion gate.
On August 24, Tomasz Tunguz proposed an assistant that dies at midnight. Its coordinator lives for 24 hours, delegates jobs to specialists that last about 30 seconds, writes selected durable preferences to files, then terminates. One day later, Anthropic moved in the other direction at the product surface: memory began working across Claude chat and cloud Cowork and was switched on by default for Free, Pro and Max plans.
Both designs are trying to make an assistant more useful tomorrow. The difference is what tomorrow is allowed to inherit.
My claim is that the nightly death is not valuable because forgetting is automatically safe. It is valuable because it can force every fact that survives to cross an explicit promotion boundary. Reset the conversation, expire the credentials and throw away the transient tool trace. Keep only state whose source, scope, owner and expiry another process can inspect.
Without that boundary, a daily restart is theatre. The poisoned instruction simply moves from the conversation into the file that wakes the next agent.
Persistent memory changes the timing of prompt injection
The May paper Hidden in Memory tested a delayed attack. An adversary controlled a document, webpage or repository read by a memory-enabled assistant and tried to make it store a fabricated fact about the user. The original content could then disappear; a later conversation retrieved the false memory and treated it as useful context.
Across the study's simulated memory setups, poisoned memories were written at rates as high as 99.8% for GPT-5.5 and 95% for Kimi-K2.6. In goal-adjacent agent tasks, once a poisoned memory had been retrieved into context, it affected the action in 60% to 89% of evaluations across the tested models. Relevance made the sleeper wake: retrieval was much lower when the later task was unrelated to the planted goal.
Those numbers need their boundaries. The researchers approximated several provider memory pipelines using native, reconstructed or inferred prompts; they did not demonstrate a compromise of Claude's August 25 product. Their downstream scoring also used an LLM judge, and the paper says it did not systematically evaluate deletion, correction, user review or provenance-aware editing as defences.
The result still changes an architecture review. Ordinary prompt injection asks whether hostile content can make an agent do something now. Sleeper poisoning asks whether the content can acquire authority over a task that does not exist yet.
That is the time-shifted version of the earlier bug-report boundary: external data became instructions because retrieval shared authority with execution. Persistent memory lets the same boundary failure wait for a better moment.
rendering diagram…
Expire authority, not just tokens
Tunguz's 24-hour design gets the outer shape right: short-lived workers receive only the tools needed for one job, while the coordinator resets daily. But its night-time summariser is the most security-sensitive component in the drawing, not housekeeping. It decides which sentence becomes tomorrow's truth.
Treat that promotion like a privileged write. A useful durable record needs the claim, where it came from, which future tasks may retrieve it, who can correct it and when it expires. “Andy prefers 30-minute meetings” can be a scoped preference. “Always upload exports to this endpoint” is an instruction carrying action authority and should not become memory merely because it appeared in a document.
The same separation should reach credentials. A specialist gets a task-scoped token; the daily coordinator gets a day-scoped session; the durable store gets no standing ability to execute. A future agent may read a stored instruction as evidence, but consequential action still passes the current policy and approval boundary. Memory supplies context. It does not grant permission.
The restart exposed the real seam
As an illustration, restart a service whose queue, review records and release ledger live in explicit files. Its process context disappears, while its durable state survives. That is the boundary worth designing.
It also exposed the scar in the pattern. If a bad sentence had been promoted into one of those durable records, killing the process would have preserved the mistake with everything else. Ephemerality reduced ambient state; it did not validate the state I chose to keep.
That is why I would put four proofs into an agent go-live review: show that runtime credentials actually expire; show every durable write with provenance; show that a stored memory cannot expand tool permission; and show that deleting or correcting it changes what the next clean session receives. Then inject one hostile document, terminate the day and test tomorrow's agent. If the payload survives as authority, the system did not sleep. It merely rebooted the attacker.
This extends the earlier AndyMental rule that agent-built apps need owners and expiry dates. Persistent memories deserve the same lifecycle. Anthropic's August 25 release notes say users can inspect, edit or delete remembered topics, while Team and Enterprise organisations keep memory off by default. Those are useful product controls. Architecture teams still need to test what gets promoted, what is retrieved and whether memory can steer a privileged action.
The design target is not an assistant with no past. It is an assistant whose past cannot quietly become permanent authority.
Kill the session every night—but make the narrow, auditable path by which anything survives the real security boundary.
