Agent memory needs correction as well as storage

  • Anthropic tests how Claude checks and reorganizes its own memories — Keep original evidence searchable, then test whether reorganized notes improve answers enough to justify their upkeep.
    • The November 6 report separates transcripts, memory notes, linked reference pages and information loaded into every session. An agent is a model running a multi-step task with tools.
    • Its background process, called dreaming, checks notes against earlier transcripts and reorganizes them. A demonstrated game-navigation correction fixes a false location, but represents one illustrative run.
    • On 25 questions about roughly 350,000 company files, search alone meets 53% of graded criteria. Search plus a wiki reaches 61% after 128 preparation sessions.
    • The wiki alone reaches 48%, below search alone. Combining them saves about 20,000 tokens per question, where tokens are units of information a model processes and generates.
    • In a legal-document example, concurrent writers overwrite contract facts. Separate pages and verbatim terms raise preserved facts from 41 of 57 to all 57 after instructions are tuned.
    • The linked wiki quickstart and dreaming cookbook provide implementations on hosted Claude Managed Agents. The cookbook explicitly excludes zero-data-retention eligibility.
    • Caveat: These are Anthropic’s own task-specific tests, and preparation costs and tuned instructions prevent treating the reported gains as a general memory-system advantage. (HN 60 points · 31 comments · complete research account and implementation documentation)

Shorter conversations can help, but the model and bill matter

  • Researchers test frequent summaries instead of ever-longer AI conversations paper notes → — Measure task success and actual spending before shrinking a coding assistant’s working history.
    • The November 3 paper compares Claude Opus 4.5 and GPT 5.6 Sol across six multi-step task suites and seven long-document suites. Large inputs remain searchable files.
    • Resetting after every action keeps typical peak conversations at 7,000–9,000 tokens. On 500 software-repair tasks, Opus solves 70.2% versus 70.0% with full history, while GPT falls to 82.4% from 84.4%.
    • Claimed cost reductions of 2.2–8.8 times for Opus and 2.4–5.0 times for GPT use hypothetical context-sensitive prices derived from other models’ serving measurements. They are estimated economics, not measured API discounts.
    • At published standard prices, GPT’s software-repair run instead rises from $167.68 to $203.12 with a 16,000-token limit and summaries triggered at 12,000 tokens. Extra generated text can outweigh shorter history.
    • Local-model results vary sharply: Qwen 3 Coder Next falls from 53.0% to 3.6% on software repairs at that limit. Summaries preserve the task, verified findings, remaining steps and completion checks.
    • Caveat: The study evaluates autonomous fixed tasks, so preserving success through changing human instructions or across arbitrary local models still requires separate tests. (Bluesky @alphaxiv.org · collected discussion · arXiv 2611.05306v1 · full methods, price model and local-model appendix)

Exposed testing consoles create another route to misuse

  • Censys finds hundreds of exposed AI security-testing consoles — Keep agent control panels and their working files behind access controls, even when their intended job is testing other systems.
    • Censys’s November 5 scan account counts 1,465 hosts exposing ARTEX consoles. Removing two identically configured hosting groups containing 493 and 157 hosts leaves about 815 distinct-looking deployments.
    • Detection combines page titles with Next.js web assets. Repeated hosting templates can inflate host counts, and a reachable console alone establishes neither a distinct operator nor a malicious deployment.
    • Censys also finds 32 open directories on ARTEX hosts exposing working files and attack tools. Another 155 hosts, or 10.6%, carry at least one additional threat-tool detection.
    • The console needs no public-facing access for its normal work. Restrict its network reachability and inspect file-serving processes separately from the model’s own instructions.
    • October 30’s campaign coverage describes earlier human-directed intrusions; this new scan measures exposed infrastructure rather than another campaign’s victim count.
    • Caveat: These scan matches include legitimate testing systems, and the approximate deployment count is a heuristic rather than a count of confirmed attacks. (Techmeme · TechCrunch reporting · primary Censys methods and exposure counts)
All gathered items - what was cut and why (10)