What is the difference between RAG and agent memory?

RAG fetches outside knowledge that is relevant to the question, such as documentation. Memory keeps what the agent has learned over time and must track what is still true. A RAG store can return an old fact because it is relevant, even after it was corrected. Memory needs updates, contradictions and expiry.

Why does my AI agent remember outdated information?

Because most memory systems search by similarity, not by time. An old fact and its correction look equally relevant, so both come back. Systems built for state, such as Zep's Graphiti, mark the old fact invalid with a validity window instead of deleting it, and prefer the newer one.

Is a vector database enough for agent memory?

Not by itself. It is good at finding relevant past text. It does not know which facts were replaced or which conclusions depended on a fact that was later disproved. On LongMemEval, Zep's temporal memory raised temporal-reasoning accuracy from 45.1% to 62.4% with gpt-4o compared with full context.

How does OpenClaw memory work?

OpenClaw memory is plain Markdown in the agent workspace. MEMORY.md holds curated long-term facts and loads at session start. Daily notes in memory/YYYY-MM-DD.md are searchable with memory_search, using hybrid vector and keyword search. Before compaction, a memory flush turn writes notes. Dreaming, on by default, promotes strong notes into MEMORY.md.

What is memory poisoning in AI agents?

An attacker plants an instruction in the agent's memory, and it affects later sessions. The July 2026 paper 'Bad Memory' tested Claude Code and Codex and found that payloads already planted in memory files can attack current and future sessions. Another 2026 study reached up to 32.5% attack success from a single poisoned observation.

← All guides

Guides November 1, 2026

Agent Memory Explained: State, Not a Vector Database

Most agent memory is built as search: save past text, embed it, and pull back what looks relevant. That answers one question well. It fails at another: what is true now? A fact you corrected last week is still 'relevant', so the agent keeps using it. In 2026, more builders treat memory as state, not search. This guide explains the difference, the five terms people mix up, the data, and how OpenClaw stores memory.

Bottom Line

Retrieval asks: what from the past is relevant to this question?
State asks: given everything learned so far, what is true now?
A vector store answers the first question. It cannot tell that a fact was replaced, so it can return stale facts.
Good memory needs updates, contradictions and expiry, not only search.
Memory is also an attack surface. An instruction planted in memory can affect every later session.

The Five Terms People Mix Up

Term	What it is	Question it answers	Example
Context	What the model sees on this call	What can I use right now?	The current chat, files read this session
RAG	Search over outside knowledge	What document is relevant?	Search the product docs
Memory	What the agent keeps over time	What do I know about this user or project?	”The user deploys with GitHub Actions”
Skills	Stored procedures	How do I do this kind of task?	A release checklist in a `SKILL.md`
Tools	Things the agent can do	What action can I take?	Run a command, call an API

Memory is the one that changes. Docs change rarely, and skills change when you edit them. Memory changes every session, and some of what it holds stops being true.

Retrieval vs State

Jordy Zomer put the split into two questions, in a post from 28 August 2026:

“What information from the past is relevant to this question?”
“Given everything we have learned so far, what is currently true?”

His motivating failure: an agent built a conclusion on an assumption. A later check disproved the assumption. The vector store still returned the old fact, because it was still relevant, and nothing knew which conclusions depended on it.

An example of our own: you tell your agent in March that the app runs on Heroku. In June you move it to Fly.io and say so. Ask “how do I deploy?” and a similarity search may return both notes, or only the March one. A state-based memory marks the March note as replaced.

How state-based systems handle change

System	How it handles a changed fact
Zep / Graphiti	Each fact has a validity window. “Old facts are invalidated — not deleted.” The newer fact wins
Mem0	Has a `DELETE` step for memories that new information contradicts. Its graph version marks them invalid instead
LangMem profiles	One document per user that “updates the existing document rather than creating a new one”
Lemmalog	The model extracts facts, and a Datalog engine works out what follows from them and retracts what no longer holds
LinkedIn’s memory agent	Fresh information gets priority, with a conflict policy and offline clean-up of stale entries

LinkedIn’s team also moved part of its system off GraphRAG, which they said was “slow and it’s also not cost efficient”, to a tree structure that allows small updates.

What the Benchmarks Show

Two benchmarks test memory over long conversations:

LongMemEval (500 questions) tests extraction, multi-session reasoning, time, knowledge updates and knowing when not to answer. Commercial assistants showed about a 30% accuracy drop over long interactions.
LoCoMo uses conversations of about 300 turns over up to 35 sessions.

Time-aware memory helps on time questions

From Zep’s paper, LongMemEval, full context against Zep:

Category	Model	Full context	Zep
Temporal reasoning	gpt-4o	45.1%	62.4%
Temporal reasoning	gpt-4o-mini	36.5%	54.1%
Knowledge update	gpt-4o	78.2%	83.3%
Knowledge update	gpt-4o-mini	76.9%	74.4%

But memory does not always beat full context

From Mem0’s own paper, LoCoMo, judged by an LLM:

Method	Overall	Temporal questions
Full context	72.9%	Not reported
Mem0 with a graph	68.4%	58.1%
Mem0	66.9%	55.5%
Zep	66.0%	49.3%
Best plain RAG	61.0%	Not reported
OpenAI memory	52.9%	21.7%

Read both tables together. If the whole history fits in the context, full context can be the most accurate. Memory systems win on cost and speed: Mem0 reports more than 90% lower token cost. On time questions, structured memory beats plain chunk search by a wide margin.

Lemmalog’s author reports that his system used about 2,700 tokens per LongMemEval question against about 104,000 for full context. He also says the test used only 17 questions per category, and answers his own question of whether it proves anything with “Not quite yet.”

Memory Poisoning

Memory that survives sessions also keeps attacks alive.

Study	Finding
”Bad Memory” (July 2026)	Tested Claude Code and Codex. Getting an agent to overwrite its own memory files was hard. But payloads already planted there “can successfully attack current and future sessions”
MINJA (2025, updated 2026)	An attacker can add malicious records to an agent’s memory only by sending it queries
”Poison Once, Exploit Forever” (April 2026)	One poisoned observation on one site activated later on other sites. Attack success reached 32.5% on GPT-5-mini

The Bad Memory authors say persistent memory “changes the threat model for prompt injection”. What to do:

Read your memory files. In OpenClaw they are plain Markdown, so you can.
Do not let untrusted content write to memory. Keep a reader agent with no write access for web pages and email.
Expire old notes. Anthropic’s memory tool docs suggest you periodically delete memory files that nobody has opened.

Our local LLM prompt injection guide covers the rest of the defense.

How OpenClaw Memory Works

OpenClaw memory is plain Markdown in the workspace (default ~/.openclaw/workspace). The docs say the model remembers only what is saved to disk.

File	Role	Loaded
`MEMORY.md`	Curated long-term facts and decisions	At session start. Cut if over the bootstrap budget
`USER.md`	Preferences and profile facts	At session start, with a small budget
`memory/YYYY-MM-DD.md`	Daily notes	Today’s and yesterday’s on `/new` or `/reset`. The rest by search
`DREAMS.md`	The Dream Diary	Optional

In state and retrieval terms (our framing): MEMORY.md and USER.md are the state. The daily notes are the retrieval layer.

The settings

Setting	Default	What it does
`memory.search.enabled`	`true`	`memory_search` over notes, hybrid vector and keyword
`memory.search.provider`	`"openai"`	Embeddings provider. `"none"` gives keyword-only search
`memory.search.query.maxResults`	`6`	Results per search
`memory.search.query.minScore`	`0.35`	Lowest match score returned
`agents.defaults.compaction.memoryFlush.enabled`	`true`	A silent turn writes notes before compaction
`agents.defaults.compaction.memoryFlush.softThresholdTokens`	`4000`	How early the flush starts
`plugins.entries.memory-core.config.dreaming.enabled`	`true`	Promotes strong notes into `MEMORY.md`
`plugins.entries.memory-core.config.dreaming.frequency`	`"0 3 * * *"`	Runs at 03:00 daily

Two built-in state behaviors:

Dated notes decay. OpenClaw ranks daily notes with a 30-day half-life. MEMORY.md and USER.md never decay.
Dreaming promotes, with gates. Only the deep phase writes to MEMORY.md, and untrusted content is excluded from promotion. Check what it would promote with openclaw memory promote-explain "<query>".

Useful commands: openclaw memory status, openclaw memory search "query" and openclaw memory index --force.

Make OpenClaw memory act like state

Keep MEMORY.md as current facts only. When a fact changes, edit the line. Do not add a second line.
Date your decisions: “2026-11-01: deploy moved to Fly.io (was Heroku).”
Let daily notes hold history. They decay and stay searchable.
Read MEMORY.md after Dreaming runs, and remove anything wrong.

For memory plugins (Hipocampus, ClawVault, mem0, Letta), see OpenClaw memory systems compared. For a fully local setup, see a local memory stack for Hermes and OpenClaw.

Honest Caveats

Vendors run their own benchmarks. Zep, Mem0 and Lemmalog each publish results where their system does well.
The “OpenClaw” scores in third-party comparisons (0.244 on LongMemEval, 0.557 on LoCoMo in Lemmalog’s post) do not say which OpenClaw memory setup was tested.
The Heroku to Fly.io example is ours. It shows the pattern; it is not from a study.
We did not run these memory systems for this guide.

Sources

Jordy Zomer: I accidentally turned LLM memory into program analysis (28 August 2026) and Lemmalog
Stack Overflow: Inside LinkedIn’s cognitive memory agent (25 August 2026)
Zep: A Temporal Knowledge Graph Architecture for Agent Memory and Graphiti
Mem0 paper (April 2025)
MemGPT (2023)
LangMem conceptual guide and LangGraph memory
Claude API: memory tool
LongMemEval and LoCoMo
Bad Memory: prompt injection risks from memory (July 2026), MINJA, Poison Once, Exploit Forever (April 2026)
Stack Overflow: what’s new on Stack Overflow for Agents (September 2026): Playbooks as procedural memory
OpenClaw docs: memory, memory config, dreaming