Privacy-preserving long-term memory for Artificial Intelligence agents

2026-07-20 · agentic-ai memory-context security-risk governance-policy · medium · source → · wiki →

key claims

GitHub Copilot Memory implements the strongest documented collection and retrieval controls among the products reviewed, restricting fact creation to users with repository write access, binding facts to a single repository, and re-validating each fact's supporting citation against the current branch before useGitHub Docs (n.d.)
OpenAI's ChatGPT derives a "chat history" reference layer from prior conversations without requiring the user to select the specific fact being stored, which is a materially weaker collection-time consent model than the explicit "saved memories" write path it offers alongside itOpenAI (2024)
Deleting a ChatGPT conversation does not delete the memories derived from that conversation, so a user must separately locate and delete the memory record to exercise an effective erasure control, a distinction the product's own documentation states explicitlyOpenAI (2024)
Google Gemini's Personal Intelligence requires an explicit per-app Connected Apps consent step before any external app data personalises a Gemini chat, and is unavailable for work, school, or supervised Google Accounts, which gives it a narrower default consent surface than ChatGPT's inferred chat-history layer despite drawing on more data sources once connectedGoogle (n.d.)OpenAI (2024)
The query-only Memory INJection Attack (MINJA) demonstrates that an attacker can corrupt an agent's persistent memory purely by issuing queries and observing outputs, without any direct write privilege to the memory store, by using bridging queries and a progressively shortened indication prompt to make a malicious record retrievable by later, unrelated victim queriesDong et al. (2025)
Because MINJA exploits the agent's own memory-consolidation behaviour rather than a storage-write permission gap, access-control models that restrict only who can directly write to a memory store, such as GitHub Copilot Memory's write-access gate, do not by themselves prevent this class of attackDong et al. (2025)GitHub Docs (n.d.)
EchoLeak (CVE-2025-32711) is a documented real-world zero-click prompt injection exploit against Microsoft 365 Copilot in which a hidden instruction embedded in an email was later retrieved and acted on when the user issued an unrelated query, exploiting the fact that the system blended new user input and previously ingested content into one undifferentiated contextGujral (2025)National Vulnerability Database (2025)
Encryption of stored memory does not defeat the leakage mechanisms this item identifies, because retrieval-time plaintext exposure, embedding inversion, and membership inference against vector-indexed memory all exploit the point at which content is decrypted for the model to reason over it, not the storage mediumInstitute (2026)Morris et al. (2023)Anderson et al. (2024)

Research Question

How can Artificial Intelligence (AI) agents preserve the utility of long-term memory for personalisation and historical context while enforcing privacy, security, and data-sovereignty controls strong enough to prevent sensitive-data leakage, unsafe recall, or non-compliant retention?

Findings

(Populated from §6 Synthesis above.)

Executive Summary

No reviewed production Artificial Intelligence (AI) memory system documents strong controls across all four privacy-relevant control points simultaneously: explicit collection consent, storage-layer scoping, retrieval-time validation, and audited deletion.
GitHub Copilot Memory has the strongest documented collection and retrieval controls, an explicit trigger, per-repository scoping, and citation-based validation, but no published encryption specification, while OpenAI's ChatGPT has the most permissive collection model and a documented gap between deleting a chat and deleting the memories derived from it.
Published memory-specific attacks, query-only memory injection (MINJA) and the EchoLeak zero-click exploit (CVE-2025-32711), demonstrate that restricting who can directly write to a memory store does not prevent an agent's own memory-consolidation and context-blending behaviour from being exploited as the effective write path.
Encryption of stored memory is a necessary but insufficient control, because every documented leakage mechanism operates at the point where content is decrypted for the model to reason over it, not at the storage medium itself.
The most actionable and least-addressed gap is audited deletion: no reviewed system logs deletion as a governance event, which falls short of the demonstrable-accountability standard the General Data Protection Regulation (GDPR)'s Right to Erasure requires.

Key Findings

GitHub Copilot Memory implements the strongest documented collection and retrieval controls among the products reviewed, restricting fact creation to users with repository write access, binding facts to a single repository, and re-validating each fact's supporting citation against the current branch before use.
OpenAI's ChatGPT derives a "chat history" reference layer from prior conversations without requiring the user to select the specific fact being stored, which is a materially weaker collection-time consent model than the explicit "saved memories" write path it offers alongside it.
Deleting a ChatGPT conversation does not delete the memories derived from that conversation, so a user must separately locate and delete the memory record to exercise an effective erasure control, a distinction the product's own documentation states explicitly.
Google Gemini's Personal Intelligence requires an explicit per-app Connected Apps consent step before any external app data personalises a Gemini chat, and is unavailable for work, school, or supervised Google Accounts, which gives it a narrower default consent surface than ChatGPT's inferred chat-history layer despite drawing on more data sources once connected.
The query-only Memory INJection Attack (MINJA) demonstrates that an attacker can corrupt an agent's persistent memory purely by issuing queries and observing outputs, without any direct write privilege to the memory store, by using bridging queries and a progressively shortened indication prompt to make a malicious record retrievable by later, unrelated victim queries.
Because MINJA exploits the agent's own memory-consolidation behaviour rather than a storage-write permission gap, access-control models that restrict only who can directly write to a memory store, such as GitHub Copilot Memory's write-access gate, do not by themselves prevent this class of attack.
EchoLeak (CVE-2025-32711) is a documented real-world zero-click prompt injection exploit against Microsoft 365 Copilot in which a hidden instruction embedded in an email was later retrieved and acted on when the user issued an unrelated query, exploiting the fact that the system blended new user input and previously ingested content into one undifferentiated context.
Encryption of stored memory does not defeat the leakage mechanisms this item identifies, because retrieval-time plaintext exposure, embedding inversion, and membership inference against vector-indexed memory all exploit the point at which content is decrypted for the model to reason over it, not the storage medium.
The Model Context Protocol (MCP) currently lacks a standardized method for authenticating agents or delegating scoped, intermediate permissions to external services, forcing a binary choice between full delegation and no access at all, which the New America Open Technology Institute brief identifies as a structural precondition for cross-service leakage of sensitive inferences between connected tools.
No reviewed production agent-memory system logs deletion as an audited governance event, which does not meet the demonstrable-accountability standard the GDPR's Right to Erasure and accountability principles require of a data controller processing personal data.
Bi-temporal invalidation, the pattern of marking superseded facts invalid with timestamps rather than deleting them to preserve point-in-time query history, is in direct tension with a hard-delete erasure requirement unless the superseded record is also purged rather than merely marked invalid.
The Open Worldwide Application Security Project (OWASP) Agentic Security Initiative names memory and context poisoning as a distinct top-level risk category in its Top 10 for Agentic Applications, defined by persistence beyond a single session, temporal decoupling between injection and exploitation, and privileged input vectors that extend beyond the direct prompt channel to any process able to write to persistent memory.

Assumptions

This item assumes that user-facing "delete my memory" controls in the four reviewed products delete only the retrievable memory record and not any parametric influence the interaction may have had on underlying model weights.
No product's public documentation reviewed here makes a parametric-unlearning claim, and the peer-reviewed GDPR-and-LLM analysis treats machine unlearning as a distinct, unresolved technical problem separate from record deletion, which is consistent with this assumption rather than evidence against it.
This item assumes that Mem0's self-reported LoCoMo, LongMemEval, and BEAM benchmark figures are directionally informative about retrieval efficiency but not independently verified measures of the product's real-world accuracy.
The evaluation framework backing these figures is open-sourced by the same vendor that reports the results, and no third-party reproduction was found in this session, so the figures are treated as a vendor claim rather than a corroborated fact.
This item assumes that encryption-at-rest is present in some unspecified form across the four commercial memory products reviewed, despite the absence of a published specification for any of them.
This assumption follows standard enterprise cloud-storage practice referenced implicitly by GitHub, OpenAI, and Google's broader platform security documentation, but no memory-specific encryption claim was directly verified in this session, so the assumption is treated as a plausible baseline rather than a demonstrated control.

Analysis

[inference] The four control points, collection consent, storage scoping, retrieval validation, and deletion audit, are analytically independent because the reviewed products each document strength at some points and silence at others, so no single composite score captures product-level privacy posture. GitHub Copilot Memory's documentation specifies concrete storage- and retrieval-layer mechanisms, citation re-validation and per-repository binding, that OpenAI's and Google's published documentation do not describe at the same level of technical detail for their own products. An alternative reading, that OpenAI's broader chat-history layer is simply a more capable feature rather than a weaker consent control, does not hold against the product's own documentation, which frames chat-history reference as an opt-out default rather than an opt-in choice, a consent-model distinction independent of the feature's retrieval capability. The query-only Memory INJection Attack (MINJA) and the EchoLeak zero-click exploit are the only memory-specific attacks in this item's source set with a released reproduction artefact or an assigned Common Vulnerabilities and Exposures (CVE) identifier, unlike the OWASP Agentic Security Initiative's ASI06 category, which the item treats as a taxonomy rather than a demonstrated exploit. Applying MINJA's attack mechanism, query-only memory consolidation, against GitHub Copilot Memory's documented write-access gate shows the gate does not address this attack class, because MINJA does not require the write-access privilege the gate restricts. The New America brief's argument that agentic memory's technical value proposition, persistence and cross-service inference, is structurally opposed to the GDPR's data-minimisation requirement to retain only what a specific, bounded purpose requires supports treating memory utility and data minimisation as genuinely in tension rather than reconcilable through interface design alone.

Risks, Gaps, and Uncertainties

The single largest gap identified is the absence of any documented encryption specification for the four commercial memory products reviewed; this item's encryption-at-rest assumption is a plausible baseline, not a verified control, and a future item with access to vendor security whitepapers or Service Organization Control 2 (SOC 2) reports could close this gap directly. The comparative claims in Key Finding 6 (write-access gating does not prevent MINJA-class attacks) combine an attack paper that did not target GitHub Copilot Memory directly with a product whose control model was described independently; no source in this item documents an actual MINJA-style attack executed against Copilot Memory, so the claim remains an architectural inference rather than a demonstrated exploit against that specific product. Mem0's benchmark figures and the MemoryGraft preprint's claimed attack-success percentages are both vendor- or secondary-source-only figures that could not be independently corroborated in this session; neither is used as a load-bearing quantitative claim in the Key Findings above for that reason. No source reviewed in this item documents a production mechanism for jurisdiction-aware retrieval-time filtering of memory content, despite the cross-border risk the New America brief raises; this is a design gap rather than a resolved finding and is carried forward as an open question.

Open Questions

What would a jurisdiction-aware retrieval-time filter for persistent agent memory look like architecturally, and has any vendor documented one?
Does GitHub Copilot Memory's citation-based validation mechanism withstand a MINJA-style query-only injection attack in practice, and has anyone tested this directly?
What does a demonstrably audited deletion event (as opposed to an unaudited content operation) look like as a concrete logging schema for agent memory systems, and does any vendor or open-source project already implement one?
How do enterprise Copilot Business/Enterprise administrator bulk-export and bulk-delete controls for user-level preferences interact with an individual user's own GDPR erasure rights when the two are exercised in conflict?