When agent memory backfires: what MemTrapBench found

Memory is supposed to help. It doesn't.

Every agent framework I've touched in the last two years ships with a memory layer bolted on somewhere — a vector store logging past turns, a summarizer condensing old sessions, a scratchpad the agent writes to and reads back on the next run. The pitch is always the same: more context about what happened before makes the agent smarter now. A new benchmark called MemTrapBench, from Mengru Wang and eight co-authors, tests that pitch directly and finds it wanting. Across two model families and five widely used memory frameworks, every single memory method scored worse than no memory at all — and even the best of them lost more than 10 percentage points.

Two ways memory turns on you

The authors call these failures memory-induced cognitive traps, and split them into two families.

Reasoning Fixation is when a retrieved memory anchors the model to a pattern that no longer applies. It shows up three ways: cognitive bias, where a strategy that worked earlier gets overgeneralized to a case that needed something different; trauma, where negative feedback on a past attempt makes the model avoid a strategy that is actually correct this time; and task boundary, where rules or constraints from a previous task leak into the current one after the task has already changed.

Belief Distortion is the more corrosive of the two: memory changes what the model treats as factually true. The clearest case the benchmark tests is safety — a counterfactual or false premise established earlier in the conversation gets carried forward and overrides the model's own judgment about physical reality or safety, even when the current query is one a memoryless model would answer correctly without hesitation.

To provoke these traps, the benchmark builds 1,050 multi-turn dialogues, 18 to 40 turns long, following a three-stage recipe: plant a trap early in the conversation, bury it under enough unrelated turns that naive retrieval doesn't trivially surface or suppress it, then spring it with a query that only fails if the earlier trap re-enters the model's reasoning. The scenarios split unevenly — 350 cognitive-bias instances, 350 task-boundary, 200 safety, 150 trauma — reflecting how differently each trap has to be engineered into a conversation.

The numbers are not subtle

The paper evaluates two models, Gemini-3-Flash-Preview and Qwen3-30B-A3B-Instruct-2507, against five memory frameworks: FullText (the whole conversation history, unmodified), LightMem (staged compression), MemOS (a unified heterogeneous memory system), SimpleMem (structured semantic compression), and EverMemOS (hierarchical memory organization). Each framework exists to make an agent perform better than it would starting from a blank context. On MemTrapBench, all five make it worse.

Gemini answers 85.2% of instances correctly with no memory at all. Give it the full conversation history and accuracy drops to 60.7%. MemOS lands at almost the same spot, 60.7%. SimpleMem is worst, at 54.7% — a 30-point collapse. Even the strongest framework, EverMemOS, still finishes at 71.2%, 14 points under the no-memory baseline. Qwen3-30B tells the same story at smaller scale: 81.8% with no memory, falling into a 62.9%–71.0% range depending on framework, with MemOS again the weakest at nearly a 17-point drop.

The ordering is worth sitting with. The frameworks doing the most work to compress and structure memory — MemOS, SimpleMem — aren't the safest option; they're often the worst, because a cleanly extracted "fact" or "strategy" is exactly the kind of confident, decontextualized summary that reasoning fixation and belief distortion feed on. Raw FullText isn't much better either. More context isn't the fix here — it's frequently the vector.

AdaptiveMem: teaching the model to doubt its own memory

The authors' proposed fix, AdaptiveMem, doesn't touch the memory pipeline at all. It's a prompt-level instruction injected at inference time that tells the model to interrogate memory before acting on it. Concretely, it asks the model to run a small decision procedure: identify the live task from the latest query alone, retain only the prior context that's clearly relevant to that task, and default to the current query and objective truth whenever they conflict with what memory suggests. It names the four traps explicitly in the instruction — anchor to the current query rather than carried-forward task scope, reassess strategy from a clean slate when the task shifts, don't let the emotional residue of a bad outcome veto a correct approach, and trust direct judgment on safety and physical reality over an earlier, possibly false, claim.

It works, and it doesn't cost anything to get it. On MemTrapBench, AdaptiveMem recovers up to 14.9 points on Gemini with LightMem, 11.8 with FullText, and 11.3 with EverMemOS, with smaller but consistent gains of 2.5–4.2 points on Qwen. On standard long-memory benchmarks like LongMemEval — which test whether a memory system correctly retrieves and uses relevant history — AdaptiveMem doesn't trade away performance to get there; it improves it slightly, by up to 4 points on Gemini and 3 on Qwen. That combination is the interesting part: the traps aren't an inherent cost of having memory, they're a cost of using it uncritically.

What this means if you're building agents

I lead generative and agentic AI work in production, and this result names something I've seen without having good language for it: an agent that gets corrected once and then over-applies the correction to every superficially similar case afterward, including the ones where it doesn't apply. Or an agent that inherits a scope restriction from an earlier task and keeps quietly enforcing it three tasks later, long after the restriction stopped being relevant. MemTrapBench gives those failure modes a name and a way to measure them, and it makes a case the field has been slow to accept: memory is not a free upgrade you bolt onto an agent to make it more capable. It's a second input channel with its own failure surface, and better retrieval or better compression doesn't shrink that surface — it can widen it, because a well-compressed memory is a more persuasive, more confident-sounding trap than a messy one.

The practical takeaway isn't to strip memory out of agents. It's that memory systems deserve the same adversarial evaluation as any other input to a model, and that a cheap instruction like AdaptiveMem's decision procedure is a reasonable default until memory frameworks are routinely evaluated on how well they resist misleading the model — not only on how well they retrieve.