Who Owns an AI’s Memory?
AI assistants are getting better at remembering us, but who owns what they remember, and how do we know it’s true? We explain why trustworthy agent memory needs identity, provenance, time, uncertainty and governance, and share what our first experiments with WoGraph, WoCell and Hippocampus² show, including where they still fail.
Why we’re building a semantic memory infrastructure for AI-native organizations.
AI assistants are getting better at remembering us. But who owns what they remember: and how do we know that their memories are true?
We are rapidly moving from a world in which AI answers questions to one in which AI systems remember our preferences, participate in our work, interact with customers, and accumulate experience.
ChatGPT remembers conversations. Claude maintains persistent memories. Both now consolidate them in the background through a process each company calls dreaming, an idea with a long history in neuroscience and machine learning, where sleep-like phases replay and reorganize what was learned. Both approaches are advancing quickly.
Yet the emergence of persistent AI memory raises questions that go well beyond the quality of the next answer.
What happens when an agent remembers something incorrectly? When a business decision changes? When knowledge shared in confidence becomes available in another context? When different agents develop contradictory understandings of the same organization?
And, perhaps most fundamentally, who controls what the system learns from the information we provide?
At WordLift, we believe these questions are connected. We are building a semantic memory infrastructure designed to preserve organizational meaning while allowing AI systems to learn, collaborate and act.
Our hypothesis is that trustworthy agent memory requires more than the ability to retrieve the past. It requires identity, provenance, temporal reasoning, explicit uncertainty, and governance.
When company knowledge slips out of your control
One of the most important consequences of generative AI adoption is the movement of organizational knowledge into systems that organizations do not necessarily control.
Employees ask AI assistants to summarize internal documents, review contracts, analyze commercial proposals, prepare strategy and interpret customer relationships.
Often, these are precisely the materials that represent a company’s most valuable knowledge.
Sometimes this information is deliberately disclosed to an approved enterprise service under contractual protections. Sometimes it is submitted through personal accounts, without the organization’s knowledge or authorization.
These situations are very different, but they can appear identical to the employee: type a prompt, receive an answer.
In May 2023, Bloomberg reported that Samsung had restricted employees’ use of generative AI tools after confidential source code was uploaded to ChatGPT. The case illustrated a new category of corporate information exposure: employees could disclose sensitive material simply by seeking assistance.
There was also a documented ChatGPT data breach in March 2023. OpenAI disclosed that a software bug had exposed some conversation information and potentially payment-related details for a subset of subscribers.
In Italy, the Garante per la protezione dei dati personali raised broader questions about data collection, the legal basis for model training, transparency, accuracy and the rights of data subjects.
Its December 2024 decision imposed a €15 million sanction against OpenAI. That decision was annulled by the Tribunal of Rome on March 18, 2026, because of the allocation of regulatory competence under the GDPR. The court did not resolve the substantive allegations.
Since September 2026, several researchers have publicly asked whether unpublished work they had discussed with AI assistants found its way into results later announced by the companies behind those assistants. Mathematicians Tristan Buckmaster of NYU and Andreas Thom of TU Dresden raised the question with OpenAI; another researcher raised a similar one about a biology discovery Anthropic attributed to Claude. The companies deny using the work. According to reports, OpenAI said it could not rule out that de-identified user data had helped improve its models; Anthropic said Claude is not trained on user conversations. None of these allegations has been established. What they have in common matters more than who turns out to be right: the people who contributed the knowledge have no way to verify where it went.
These episodes should not be collapsed into a single accusation.
A software breach, an employee voluntarily submitting confidential material, a provider retaining prompts, and a provider using permitted content for model improvement are separate mechanisms.
Nor is it accurate to claim that all ChatGPT or Claude conversations are used for training. Both providers distinguish consumer services from commercial offerings. As of November 2026, their published policies say that business and API inputs and outputs are not used to train their models by default, subject to specified permissions and exceptions. Consumer services have different settings and conditions.
But this does not eliminate the underlying architectural problem.
A company can lose control of its knowledge without anyone hacking its systems.
Knowledge can be dispersed across employee accounts, conversation histories, disconnected memory systems, external tools and multiple AI services.
Even where contractual protections prevent model training, the organization may still lack a shared, authoritative view of what its agents remember, which claims are current, how corrections propagate, and who may reuse particular information.
It may well be the largest leak in corporate history. No one can measure it yet, and that is part of the problem: it is a vast, largely invisible transfer of organizational context into AI workflows, one prompt at a time.
We believe organizations should be able to benefit from increasingly capable models without surrendering stewardship of their knowledge.
The illusion of remembering
The second problem is epistemic.
When an AI assistant recalls something from an earlier interaction, we instinctively interpret that as knowledge.
But a remembered statement is not necessarily a fact.
Someone may have been mistaken. The agent may have inferred more than the evidence justified. A decision may have been reversed. A policy may have expired. A customer preference may apply only to a particular project.
Persistent conversational memory can make all of these things sound equally authoritative.
ChatGPT provides a particularly revealing example of how the boundary between helpful personalization and informed consent can become blurred. In a 2026 study of 2,050 memory entries from 80 ChatGPT users, researchers found that 96% of the entries were created without an explicit instruction to remember them. The same study identified GDPR-defined personal data in 28% of entries and psychological inferences in 52%. These findings describe a specific participant sample, not every ChatGPT user; the absence of a per-entry request is also not proof that a person had disabled the overall memory feature. Nevertheless, they illustrate a real agency problem: the system may decide what belongs in a persistent portrait of someone before that person has approved the individual inference.
Deletion is a second problem. OpenAI’s own memory documentation explains that deleting a conversation does not necessarily delete the memory derived from it. Removing information fully may require changing the memory summary and deleting the original conversation and other sources that contain the detail. This is documented product behavior rather than evidence that every deletion request fails; it matters because the user’s expectation of erasure may not match the boundaries of the system’s different stores.
These mechanisms are not limited to ChatGPT: any assistant that learns implicitly from conversation must distinguish the user’s general consent to personalization from permission to retain or share a particular fact. The lesson for organizational memory is to make consent, provenance, permitted use and deletion properties of the stored knowledge, rather than relying on the assistant to infer them.
Imagine an assistant remembering that a customer agreed to purchase a product. Was this a signed commitment, an optimistic sales forecast, a quotation from a meeting, or an inference the assistant produced?
OpenAI’s June 2026 research on memory synthesis explicitly discusses problems of freshness, correctness and scalability. Anthropic’s November 2026 research shows that memory notes, linked representations and offline consolidation can help agents correct mistakes and reuse knowledge from earlier tasks.
These are important contributions.
They also clarify why memory is a difficult research problem.
A system that can summarize its experience is not necessarily capable of establishing which parts of that experience deserve to become reliable knowledge.
The real question is not just what an AI remembers. It is whether that memory is accurate, up to date, and supported by evidence.
From conversational history to semantic memory
Our approach starts with a distinction between an event, a claim, and a verified organizational fact.
An event records what happened: a conversation, an observation, a document update or a decision.
A claim states something about the world. It may be extracted from an event, inferred by an agent or asserted by a person.
A verified or approved organizational fact has a different standing. It must be supported by appropriate evidence and governed by the rules of the organization.
These representations should remain connected, rather than collapsing into one another.
A claim should retain its source. Its subject should refer to a stable entity. Its temporal validity should be represented explicitly. Corrections should not silently erase the history that explains how the organization reached its current understanding.
And an agent’s confidence should never be sufficient to promote an inference into an authoritative fact.
WoGraph is WordLift’s own knowledge graph technology: the infrastructure we build to represent, store, connect and query entities, relationships and evidence using semantic-web standards. It provides the canonical knowledge foundation on which memory can be linked to stable identities rather than trapped in isolated conversations. WoGraph is a technology we develop, not a generic name for any graph database.
This is the foundation of the memory extension we are integrating into the existing WordLift Python SDK.
The planned extension will bring developer primitives for episodic memory, structured claims, scoped recall, document-like workspaces, context assembly and lifecycle operations. Its purpose is to make memory an infrastructure component rather than a feature tied to one language model.
Rino, Lino and future *ino colleagues
Connectors and enterprise services
Approved public interfaces
remember()claim()recall()context()workspace()consolidate() / forget()This matters because organizations will change models, applications, agent frameworks and providers.
Their knowledge should remain intelligible and governable across those changes.
WoCell: memory becomes organizational
WoCell is WordLift’s framework for deploying AI colleagues: persistent, task-oriented agents that use organizational knowledge and tools while operating within defined roles and permissions. Rino, our sales AI colleague, and Lino, focused on other organizational and customer workflows, are early examples. They are not simply chatbots with a longer history; they are applications of governed organizational memory.
WoCell is where these ideas meet real operational requirements.
Our AI colleagues need to remember work across sessions while respecting the people and systems from which that knowledge originates.
A sales agent should be able to understand a customer, identify a deal, retrieve prior decisions and distinguish a current offer from an obsolete one.
But it should not treat every private conversation as shared organizational knowledge.
Our architecture therefore places explicit controls around the memory lifecycle.
Private conversations are private by default. Shared knowledge requires defined permissions. Stored statements are attributed to sources. People must be able to review, correct and remove information according to applicable policies.
Crucially, authorization is enforced through the surrounding system, not entrusted solely to the model’s instructions.
These rules are not just ethical aspirations. They are engineering properties that can be tested.
In our internal CML-Bench experiments, integrating WoCell’s memory governance gate with WoGraph improved performance on a defined suite of consent, privacy, provenance, poisoning, erasure and identity checks.
The same experiments exposed remaining limitations, including cases in which authorized people can introduce misleading material, incomplete erasure across derived artifacts, and unresolved identity ambiguities.
These failures matter. A system that reports them is more useful than one that claims perfect memory.
Hippocampus: can agents learn to navigate meaning?
Persistent memory also presents a learning problem.
An agent should not simply retrieve the nearest passage. It should understand which entities, relationships and constraints are relevant to a decision.
Project Hippocampus explores whether language models can learn to navigate structured knowledge spaces.
Our original research studied training on knowledge-graph navigation trajectories. Its results were not a simple victory for graphs over language-based reasoning.
On an initial curriculum, structured navigation underperformed a free-form reasoning baseline. When the curriculum was changed in controlled experiments, navigation improved substantially. Subsequent work showed that training format, curriculum, tool-use behavior and model capacity interact in ways that simple accuracy comparisons can obscure.
The deeper conclusion is that structured knowledge does not automatically produce better reasoning.
What matters is whether an agent learns an effective policy for finding evidence, applying constraints and recognizing when an answer is unsupported.
Project Hippocampus — Learning the Map, Not the Route (research archive on Zenodo) documents this line of investigation.
Hippocampus is a WordLift Lab research project. Thanks to Elie Raad and Venkata Pagadala for their contributions.
Hippocampus² extends this question into changing environments.
What happens when the rules governing a knowledge space change, but the agent is not told what changed?
Can it interpret corrective feedback? Revise a previously useful belief? Preserve unrelated knowledge? Distinguish an explanation that fits observed evidence from one that is actually true?
Our experiments have shown that concise, structured representations of corrective experience can improve subsequent performance relative to raw transcripts in certain settings.
But they have also exposed a more fundamental difficulty: a verifier can establish that an explanation is consistent with observed evidence without establishing that the explanation is true.
In one experiment, adding verification to typed beliefs did not improve their downstream reliability.
In a preregistered confirmatory study, active selection of corrective examples improved the number of correct decisions. Yet it also increased incorrect decisions, especially when the agent failed to question an assumption shared by all its candidate explanations.
This points to one of our most important open research questions:
How can an agent discover that its current understanding is incomplete, when every explanation it can currently imagine shares the same mistake?
We believe this is central to trustworthy adaptive memory.
One brand identity, two directions of intelligence
Memory becomes even more consequential when we move beyond an individual agent.
Organizations are now encountering AI from two directions.
Inside the organization, AI colleagues increasingly participate in operations. They interpret internal systems, remember decisions and learn from experience.
Outside the organization, AI search engines, shopping agents and customer assistants discover brands, compare offerings, evaluate claims and initiate transactions.
We think of these as introverted and extroverted agents.
Both need to understand the same organization.
Yet today, they frequently reconstruct its identity from different sources and operate with different, sometimes contradictory, representations.
The internal sales agent may know the current product configuration. An external shopping agent may encounter an obsolete description. Customer support may know that a policy changed. Another agent may continue repeating the earlier policy.
These are not merely retrieval failures. They are failures of semantic coherence across organizational boundaries.
WordLift’s central proposition is that these agents can be grounded in a common semantic foundation.
Stable identifiers define the entities that matter. Ontologies clarify relationships and constraints. Provenance connects claims to evidence. Temporal representations describe what changed. Governance determines which information can be disclosed and reused.
An internal agent may access private commercial knowledge. An external agent should receive only an authorized public projection of that knowledge.
They do not need identical access.
They need compatible meanings and consistent canonical identities.
Sales, customer work, decisions and private context. Authorized organizational memory, individual roles.
Discover verified brand identity and capabilities. Only approved public claims and actions.
Access checked before retrieval
resolve()Names to entity IDs, or no match
Approved identity, claims and capabilities
This is how we connect agent memory with our long-standing work on knowledge graphs, entity resolution, structured data and the Agentic Web.
Resolve() is WordLift’s entity-grounding service: given a mention and its context, it selects the appropriate identity from known candidate entities—or declines to resolve it when the evidence is insufficient. This helps agents distinguish a named organization, product or person from another entity with a similar label, instead of treating the text string as the identity. Explore resolve() and its live demonstrations.
Resolve() helps determine what an entity means. WoGraph provides the semantic knowledge infrastructure. WoCell puts that infrastructure into organizational practice. Hippocampus investigates how agents can learn to navigate and revise it. Our work on AI Audit and agent-facing capabilities explores how approved knowledge and actions become discoverable outside the organization.
These are complementary parts of one architecture.
The retrieval dimension is also explored in our RLM-on-KG arXiv preprint and its accompanying WordLift blog article on AI navigation of knowledge graphs. That work examines when agent-guided traversal helps gather scattered evidence; it does not establish that graphs outperform every retrieval baseline.
Our earlier Structured Linked Data as a Memory Layer for Agent-Orchestrated Retrieval, discussed in Structured Data Is Not Enough: Why AI Search Needs a Memory Layer, makes the complementary external-agent case: publicly accessible linked data and navigable entity pages can help an agent retrieve and interpret a brand through stable relationships rather than disconnected passages. The study measures retrieval and answer quality under its own protocol, not internal/external agent identity convergence directly.
What we have measured and what we haven’t
We believe ambitious claims about memory should be accompanied by strong baselines, preregistered experiments and documented failures.
The completed CML-Bench Steps 1–5 compare semantic memory with retrieval-based alternatives and test governance and temporal reasoning. In the 3,856-record experiment, WoGraph achieved 82.5% task accuracy against 67.5% for a hybrid retrieval baseline. The separate Step 5 governance suite also completed all 46 deterministic checks per architecture: 42/46 for WoGraph plus WoCell’s gate, 29/46 for WoGraph alone, and 17/46 for hybrid RAG.
This is evidence within a defined experimental setting, not proof that knowledge graphs outperform retrieval-augmented generation universally.
In the completed, preregistered Step 6 experiment, a temporal supersession layer improved task accuracy from 59.7% to 76.4% on 36 drift questions, but failed a preregistered acceptance condition concerning source attribution. We therefore rejected it under the original decision rule. The later agent-memory lifecycle suite currently contains draft scenarios and scoring guards, not completed four-arm trials.
For WoCell, we also use LongMemEval to evaluate longitudinal recall, multi-session reasoning, knowledge updates, temporal questions and abstention.
Our completed, preregistered November 7 breadth experiment found that increasing the number of retrieved memories from 10 to 20 improved multi-session accuracy on the 66-question TEST subset from 60.6% to 75.8% (paired difference +15.2 points; 95% bootstrap CI +4.5 to +25.8). On the 251-question DEV split, overall accuracy increased from 81.3% to 88.4%. A blind sample was checked before trusting the judge; the reported abstention count was 14/14 in both arms. A follow-up vector-tail experiment took place on November 8 and exposed a production context-budget mismatch; its complete scored result is not yet available, so we do not attribute new accuracy gains to it.
These are promising measurements, but the LongMemEval questions have already been used in development. Further results on the same data must be described as evaluations on reused benchmark items, rather than independent confirmation.
Our 88.4% is a DEV result on 251 questions under our own answer model and protocol. A meaningful comparison with other memory systems would need identical splits, ingestion, context limits, model, judge, scoring rules and cost accounting; we have not run one yet.
The next scientific step is to extend these studies beyond recall.
We want to measure whether a shared semantic memory reduces contradictions between independent agents; whether corrections propagate accurately across internal and public representations; whether revoked permissions are respected by derived memories; and whether agents can identify unsupported assumptions before making costly decisions.
We also want to compare ontology-grounded consolidation with increasingly strong alternatives, including linked document memories, search with versioned caches and model-generated wikis.
The winning system should be determined by the experiments, not by our preferred representation.
Memory as an organizational asset, not a provider dependency
We are not arguing that organizations should stop using ChatGPT, Claude or other general-purpose AI systems.
Their capabilities are essential to what we want to build.
We are questioning whether the memory of an organization should be inseparable from any one of them.
A company’s identity, decisions, relationships and accumulated experience should not become unintelligible when it changes its model provider.
Nor should its knowledge automatically become available for purposes unrelated to those for which it was collected.
Maintaining this boundary requires more than a knowledge graph. It also requires contractual protections, secure model gateways, data minimization, enforceable permissions, retention controls and independent auditing.
Our architecture aims to make these requirements explicit and testable while keeping model inference replaceable.
We call this direction sovereign semantic memory. As Chiara Carrozza argues in Sovereign AI Starts With Semantics, an organization can own the model and the infrastructure and still outsource the meaning. Sovereign semantic memory carries that idea into what agents remember: the meanings an organization recognizes, and the identity, evidence, permissions and lifecycle of its knowledge, remain governed by the organization, even when multiple external AI models help interpret and use it.
Sovereignty is a design objective that must be demonstrated operationally, not a guarantee conferred by architecture alone.
Learning without losing meaning
We began WordLift with the idea that every organization should be able to develop and control its own knowledge graph.
As AI becomes increasingly agentic, that idea takes on a new significance.
A knowledge graph is no longer simply a way to make information understandable to search engines.
It can become a persistent semantic foundation for an organization’s AI systems.
But that foundation must do more than preserve what is already known.
It must support correction. It must retain uncertainty. It must distinguish authorized knowledge from private experience. And it must allow agents to learn without gradually replacing evidence with their own unsupported conclusions.
We are not trying to make AI remember everything.
We are asking whether AI can develop a more disciplined relationship with knowledge—one that remains understandable, corrigible and governed as agents become more capable.
The future of agent memory should not be about who remembers the most. It should be about who can preserve meaning, recognize uncertainty, respect ownership and change their mind for the right reasons.
Sources and further reading
- Garante Privacy — ChatGPT, March 2023
- Garante Privacy — December 2024 investigation outcome, with the 2026 court update
- Tribunal of Rome — judgment of March 18, 2026
- Axios — OpenAI’s math solution overshadowed by credit controversy (September 2026)
- Cybernews — OpenAI accused of stealing work from another mathematician (September 2026)
- Trending Topics — Researchers suspect AI models absorbed their unpublished work (September 2026)
- OpenAI — How your data is used to improve model performance
- Anthropic — Consumer data training policy
- Anthropic — Commercial data training policy
- OpenAI — Dreaming: Better memory for a more helpful ChatGPT
- Anthropic — The components of agent memory
- LongMemEval — Benchmarking Chat Assistants on Long-Term Interactive Memory
- WordLift — Learning the Map, Not the Route (Hippocampus research archive)
- WordLift / Volpini & Raad — RLM-on-KG, arXiv:2604.17056
- WordLift Blog — Your Knowledge Graph Is Now a Search Space
- ChatGPT memory entry study — The Algorithmic Self-Portrait (2026)
- OpenAI — Memory in ChatGPT, including removal behavior
- WordLift — Chiara Carrozza, Sovereign AI Starts With Semantics
- WordLift — resolve() service and live demo
- Structured Linked Data as a Memory Layer for Agent-Orchestrated Retrieval — arXiv:2603.10700
- WordLift blog — Structured Data Is Not Enough
- WordLift — Python SDK documentation
Editorial note: the CML-Bench, WoCell and Hippocampus² results cited above are WordLift internal experiments.