The most useful thing published in the last few days on knowledge tooling wasn't a model release. It was a security argument: Help Net Security ran an interview with Vectorize's Chris Latimer making the case that if you do one security check this quarter, make it agent memory. That framing is worth taking seriously, because it names a gap most retrieval stacks still have.
The asymmetry between read and write
Classic RAG has a convenient property: the corpus is curated upstream. Someone decided which Confluence spaces, which S3 prefixes, which ticket queues get indexed. Access control is a filter at query time, and the threat model is mostly "did we leak a document to the wrong person." The index is append-controlled by humans.
Agent memory inverts that. The agent writes. What it writes is derived from whatever entered its context — a scraped page, a tool response, a user message, output from another agent. Then that write is retrieved later and rendered into a prompt with roughly the same authority as a vetted internal document. You have built an ingestion pipeline whose author is an untrusted upstream, and most teams have not drawn it that way on a diagram.
What this changes in the design
A few things follow, and they're cheap to add early and expensive to retrofit:
Carry provenance on every memory record, not just text and embedding. Who the writing principal was, which session, which tool returned the source content, what trust tier that tool sits in. If you can't answer "where did this memory come from" with a query, you can't answer it during an incident either.
Keep memory and documents in separate retrieval channels, and keep them visually distinct in the assembled prompt. Collapsing both into one undifferentiated block of context is how a self-authored assertion acquires the standing of policy documentation.
Treat promotion as a decision. Short-term scratch to durable long-term memory is the right place for a filter — re-verification, decay, TTL, or a cheap classifier — rather than writing everything and hoping retrieval ranking sorts it out.
Scope by principal and tenant. Shared memory across users in a multi-tenant assistant is both a leak path and a poisoning path, and it fails silently.
Why now
Tool surfaces are standardizing fast. MCP shipped a 2026-07-28 specification and has since published a revised roadmap, which means more agents are pulling content from third-party servers the deploying team didn't write. The practical control point for that content isn't the model and isn't the retriever — it's the moment of write, where you still know the origin.
Your evals probably don't cover this. Retrieval precision on a fixed corpus says nothing about what happens when an adversary can append to the corpus. If you run one new test this quarter, make it adversarial: plant a hostile instruction in a source your agent will read, and see whether it survives into next week's session.