LLM memory leakage is when an AI assistant with long-term memory brings stored details into conversations where they do not belong, such as a health detail surfacing in a work request. A related failure, memory-driven sycophancy, is when stored beliefs push the model to agree with the user instead of answering objectively. PersistBench measured both across 18 models and found median failure rates of 53% for cross-domain leakage and 97% for sycophancy.
What LLM memory leakage is
Many assistants now keep long-term memory: facts about you saved from earlier chats and fed back into later ones. That makes them more personal. It also means every saved fact can appear anywhere.
The 2026 PersistBench paper names two risks specific to memory. Cross-domain leakage is when the model pulls in a stored memory that has nothing to do with the current request. Memory-induced sycophancy is when stored beliefs reinforce the user's biases, so the model tells them what it thinks they want to hear.
How it happens and how PersistBench tests it
Memory is usually added to the model's context automatically, without regard to whether it is relevant. The model then decides what to use, and models are poor at leaving out something they have been shown.
In Inspect, PersistBench runs three tasks: persistbench_cross_domain and persistbench_sycophancy (200 samples each), plus persistbench_beneficial_memory (100 samples), which checks that the model still uses memory well when it should. The two failure tasks generate three answers per sample and keep the worst, because one inappropriate use of memory is enough to cause harm. A judge model scores each answer, and a score of 3 or more out of 5 counts as a failure.
What the results tell you
Across 18 frontier and open-source models, the median failure rate was 53% for cross-domain leakage and 97% for sycophancy. In plain terms, most models leaked irrelevant memory about half the time and almost always let stored beliefs shape their answer. For a business, that means personal or confidential context saved in one setting can surface in another, including in front of someone else using a shared account or a shared agent.
How to defend against it
Scope memory: separate it by user, by workspace and by purpose, and retrieve only what is relevant to the current task instead of injecting everything. Record where each memory came from so poisoned entries can be found and removed, let users see and delete what is stored, and expire memories that are no longer needed. Never store secrets or regulated data in conversational memory. See sensitive information disclosure and AgentThreatBench for memory poisoning.
References
- [1]PersistBench: When Should Long-Term Memories Be Forgotten by LLMs?(arXiv)
- [2]PersistBench in Inspect Evals (task docs)(Inspect Evals)
- [3]OWASP Top 10 for LLM Applications (2025)(OWASP)
- [4]OWASP Top 10 for Agentic Applications (2026)(OWASP)
Memory turns one leak into a leak in every future session. Talk to a security expert about testing how your AI assistant stores and uses what it remembers.