AI products use the word memory for several systems with different failure modes. A personalization summary, retrieval over old chats, a repository instruction file, an agent-written note, and a compacted conversation all carry information across time. They differ in storage, authority, visibility, and loss.
This field guide separates those mechanisms before comparing public evidence from ChatGPT, Codex, Claude, and Claude Code. It distinguishes four evidence levels:
- documented behavior appears in current vendor documentation;
- confirmed incident appears in a vendor status report or an acknowledged patch trail;
- public report is a reproducible or detailed user report whose cause has not been established by the vendor;
- unsupported claim lacks enough public evidence to repeat as fact.
The evidence snapshot is current through August 26, 2026. Several alarming claims in older complaint inventories describe historical behavior that the products have since changed.
What “memory” can mean
| Mechanism | Typical source | Typical failure |
|---|---|---|
| Personalization state | Facts or summaries derived from prior chats | Wrong, stale, or unexpectedly retained personal context |
| Conversation retrieval | Search over old chats | Relevant history exists but is not selected |
| Instruction files | AGENTS.md, CLAUDE.md, rules, or custom instructions |
The model sees a rule and still violates it |
| Agent-written notes | Generated summaries, topic files, or indexes | False state, destructive edits, or conflicting writes |
| Context compaction | A summary replacing older prompt history | Lost obligations, tool results, authorship, or task position |
| Product scope | Project, repository, machine, workspace, chat, or app | Information appears available on one surface and absent on another |
These distinctions prevent a common analytical mistake. A missing sidebar item may indicate a presentation-index defect while the underlying record still exists. An ignored instruction may indicate model adherence rather than failed loading. A false answer after compaction may reflect a lossy handoff rather than corruption of long-term storage.
1. Destructive rewrite or loss
OpenAI confirmed one ChatGPT memory incident on November 6–7, 2025. Its status page described missing memories, partial recovery, and possible gaps for memories created during the incident window. OpenAI marked the incident resolved on November 7. That record supports a specific outage. It does not support broader claims that ChatGPT routinely wipes all memory.
Coding agents add another path to loss because the agent can edit its own context files. A 2025 Claude Code issue reports that a request to remember one release instruction caused a MultiEdit operation to replace roughly 1,000 lines of CLAUDE.md with a placeholder and a new section. The report includes the edit payload and was labeled has repro, but Anthropic did not publish a root-cause confirmation or patch in the issue. It remains a detailed public report rather than a confirmed vendor incident.
The structural risk is clear even when incidence is uncertain: self-editable memory combines a model-generated patch with trusted persistent state. Version control, narrow edits, and rollback turn that risk into a recoverable failure. An unversioned memory surface converts one bad edit into history loss.
2. Caps and truncation
Bounded startup context is ordinary product behavior. The important questions are whether the limit is documented, whether excess content remains retrievable, and whether users can see what loaded.
Claude Code currently loads the first 200 lines or 25 KB of its auto-memory index, MEMORY.md, at session start. Topic files remain on disk and can be read on demand. Writes beyond the limit succeed, but the client returns an error asking Claude to shorten the index because excess content will be dropped on the next load. CLAUDE.md has a separate 4 MiB load limit. Anthropic also provides /context to show which instruction files loaded.
That is a bounded index with a warning path, not an undocumented silent deletion. Older descriptions that call every Claude Code worktree a separate memory silo are also obsolete: current documentation says worktrees in one repository share auto-memory.
Current OpenAI documentation does not publish the often-repeated claim that ChatGPT has a 200–400-item cap that silently overwrites old memories. The claim should remain excluded until a current vendor document, reproducible test, or incident record supports it.
3. Auto-written junk and false state
Automatic memory generation delegates editorial judgment to the model. OpenAI says ChatGPT decides which details are important and continually updates its synthesis. Anthropic says Claude Code chooses whether a correction, preference, project fact, or reference will help in a later conversation.
The resulting risk is broader than a wrong fact. A generated memory can preserve a conclusion while dropping the evidence, convert an attempted action into a completed one, or carry an incomplete diagnosis into future work. A Claude Code issue reports incomplete summaries cascading into later wrong answers. The issue is a user report, not proof of a general defect.
Generated state therefore needs an authority model. A useful memory can say, “the last run reported this test failing.” It should not silently become, “this test always fails.” Strong context references help by binding a claim to the exact file, conversation, or tool result that produced it.
4. Incomplete audit and deletion
Storage visibility and behavioral influence are different properties. ChatGPT’s current Memory FAQ says its visible summary “will not include everything” in the broader synthesis. The sources shown under a personalized answer may also omit factors that shaped the response. Fully removing a fact can require deleting every source where it appears: current and archived chats, files, the memory summary, and connected applications.
This creates an audit problem even when every control works as designed. The user can inspect a summary without seeing a complete ledger of the derived state that may influence a response.
Other products expose different controls:
- Claude’s consumer memory changed from a daily summary to categorized entries in July 2026. On August 25, Anthropic announced editable topics shared across chat and Cowork.
- Claude Code stores auto-memory as plain Markdown that users can inspect, edit, delete, and place under their own backup or versioning process.
- Codex retains local session and memory artifacts, but public reports show that the desktop interface or its indexes can temporarily hide sessions that remain present in local JSONL or SQLite storage.
The last case is a projection failure. Calling it data deletion before checking the underlying store confuses presentation state with record custody.
5. Scope and product-surface fragmentation
Memory scope changes over time and varies by product. Temporary Chat in ChatGPT does not read or create personalization memory. Project-only modes intentionally restrict which conversations can contribute context. Those are scope rules rather than recall bugs.
Claude’s consumer memory was historically partitioned by project. Anthropic changed the implementation in 2026: categorized entries replaced the daily summary in July, and chat and Cowork began sharing one memory on August 25. Claims that those two surfaces still maintain separate memory are already stale.
Claude Code now shares auto-memory across worktrees in the same repository, but that memory remains machine-local and does not automatically follow the user into cloud environments. Its main conversation’s auto-memory also does not enter ordinary subagents; forked conversations inherit the parent context, while independent subagents need their own configured memory.
Scope should be explicit in the data model and visible in the interface. “Remembered” is underspecified without the answers to: where, for whom, on which machine, inside which repository, and during which kind of run?
6. Compaction loss
Context compaction replaces older prompt history with a smaller working representation. Every summary selects. The reliability question is whether it preserves the state needed for the next action.
OpenAI Codex issue #5957 provides an unusually concrete public report. The attached trajectory showed 23 edits across six files before automatic compaction. After receiving a summary instead of the detailed tool-call history, Codex denied making the edits and attributed them to an earlier run. The issue remains a public report, but its event trail makes the failure legible: the files survived while action ownership and task position did not.
Current Claude Code documentation says project-root CLAUDE.md is read again after /compact. Conversational instructions survive only if the compacted summary preserves them or the user moves them into a persistent file. Blanket claims that root instructions always disappear after Claude Code compaction are therefore outdated.
A useful compaction contract preserves the current objective, unfinished work, changed artifacts, test results, blockers, permissions, and next action. Raw history should remain available for recovery. Agent trajectory observability can then connect the summary to the exact events it represents.
7. Token and quota tax
Memory consumes inference. Instruction files occupy startup context. Retrieval adds tokens to a turn. Background writers and consolidation jobs make separate model calls.
OpenAI acknowledged this directly in Codex issue #18699: memory consumes more tokens, and that cost alone was not treated as a bug. A later report, #19732, showed background sampling from the memory subsystem while Codex Desktop appeared idle. An OpenAI maintainer clarified that periodic background memory work was expected, while continuous idle consumption was not, then linked a patch. The distinction matters: background cost is a product choice; unbounded or invisible continuous activity was the defect.
Claude Code takes a simpler visible form of the same tax. CLAUDE.md, imports, and the auto-memory index enter the context window at startup. Anthropic recommends concise files because larger instruction sets consume context and reduce adherence.
Cost observability should identify the memory job, trigger, model, token use, and whether it ignored the user’s normal model configuration. A quota meter that moves while the visible task is idle gives the user a bill without a causal account. That is an observability failure even when the underlying work is intentional.
Security: memory becomes a privilege amplifier
Persistent state expands the impact of prompt injection. The 2026 Bad Memory study showed in a synthetic sandbox that payloads already planted in persistent files could influence future Claude Code and Codex sessions. The researchers did not establish common exploitation in the wild, and they found that inducing an agent to overwrite trusted memory from external content was difficult. The work demonstrates persistence of influence after a payload reaches the trusted store.
Ayush Paul’s Memory Heist demonstrated a different path against Claude’s consumer assistant. An attacker-controlled site led Claude to encode personal information into character-by-character URL requests while browsing. Paul reported that Anthropic later disabled the external link-following behavior used by the proof of concept. This is researcher-reported evidence with a claimed mitigation, rather than an Anthropic security advisory.
The shared lesson is architectural. A system that can read rich memory and reach an external effect surface needs controls outside the model: permission checks, destination restrictions, review for sensitive transfers, and logs that reveal which memory influenced the action.
What current controls actually provide
| Product | Inspectable state | Current qualification |
|---|---|---|
| ChatGPT | Editable memory summary and per-answer source hints | The summary and source hints may be incomplete; deletion spans multiple source locations |
| Claude | Editable categorized topics | Chat and Cowork now share memory; sensitive-topic behavior has separate settings |
| Claude Code | Plain Markdown, /memory, and /context |
Instructions are soft context; auto-memory has a bounded startup index and remains machine-local |
| Codex | Repository instructions, local session artifacts, and generated memories | Background memory has a token cost; compaction and UI projection remain separate reliability surfaces |
Product names do not define one uniform memory architecture. Controls should be evaluated against the exact surface and version in use.
Engineering response
Critical state should have a stronger home than generated memory alone:
- Keep requirements, decisions, and operational truth in inspectable source documents.
- Version memory writes and preserve rollback.
- Separate current state, historical evidence, procedures, and personal preferences.
- Use routing-based memory to select authoritative sources before similarity-ranked items.
- Preserve raw trajectories outside compacted context.
- Test compaction against open obligations, changed files, receipts, and next actions.
- Enforce hard constraints in permissions, schemas, tests, or tool gates rather than relying on remembered prose.
- Attribute background memory cost to the job that incurred it.
- Treat memory with tool access as sensitive input to an effectful system.
Persistent agent memory works best as a revisable convenience layer over retained evidence. Trust comes from the ability to inspect what changed, recover what was lost, and verify which state shaped the next action.