AI Agent Memory in 2026: Mem0, Letta, Zep and the Cloud Platforms Compared

Open a fresh session with most AI agents and you meet a stranger. It doesn't know your name, what you're building, or that it spent an hour with you yesterday chasing the same bug. The usual workaround has been to paste the old transcript into the next prompt, and that has always been a tax: more tokens, slower replies, worse accuracy. During 2026 the tax became too heavy to keep paying, and a set of purpose-built memory layers arrived to replace it.

A few numbers show the scale of the shift. Mem0's third-generation algorithm reports 94.4 on LongMemEval while spending about 7,000 tokens per query, where feeding in the full history costs 25,000 or more, and its p95 latency fell by 91%, from 17.12 seconds to 1.44. Zep's temporal knowledge graph scored 94.8% on Deep Memory Retrieval against MemGPT's 93.4%, with response times about 90% lower. Anthropic opened persistent memory for Claude Managed Agents in public beta on April 23, 2026, and Rakuten, an early adopter, reported first-pass errors down 97%, cost down 27% and latency down 34% for long-running task agents. AWS and Microsoft turned the same idea into products for their clouds. And in May 2026 OWASP started a dedicated Agent Memory Guard project, because a store that persists between sessions had become a target for attackers.

What follows is a tour of that terrain: what memory actually is, how the main systems are built, what the benchmarks do and don't tell you, where memory breaks, and where it's headed.

The amnesia problem

Anyone who has shipped an agent in the past couple of years knows the wall. Inside one session the model is sharp. Across sessions it behaves like a goldfish. Every login begins at zero, every preference gets asked again, and every fact about the user, the project or the workflow must be rebuilt from a raw transcript or crammed into the system prompt until the context bill dominates the deployment's costs.

Consumer products tried to hide the gap. OpenAI rolled ChatGPT Memory out to all paid tiers by September 2024, widened it in April 2025 to reference every past conversation, and extended it to free users in June 2025. Anthropic added automatic memory to Claude in October 2025, made it free for everyone in March 2026, and released a programmatic memory tool for Claude Managed Agents in public beta, which exposes a persistent /memory directory of files that survives across sessions. These are handy features, though neither one is a component you can embed in your own agent.

For builders, the blunt alternative of replaying the complete history on every call looks acceptable in a demo and collapses at scale. LongMemEval, a NeurIPS 2024 benchmark for chat-assistant memory, quantified it. With histories stretched to about 115K tokens, even frontier long-context models lost 30 to 60 absolute accuracy points compared with an oracle that is handed the relevant evidence directly. GPT-4o reading the entire history landed between roughly 60.6% and 64%, against an oracle ceiling of 87% to 92%. A million-token window doesn't rescue you. It simply supplies a bigger haystack for the model to lose the needle in.

By 2026 the field settled on a cleaner idea: memory is a component in its own right. It isn't a context-window trick, a RAG index over chat logs, or a prompt template. It is a first-class store with its own write path, eviction rules, retrieval API, security model and benchmarks. Activity is happening in four places at once:

• Open-source SDKs: Mem0, Letta, Zep with Graphiti, Cognee, LangMem and Memori.
• Hyperscaler products: AWS Bedrock AgentCore Memory, Microsoft Foundry's user-scoped memory, and Anthropic's Claude Managed Agents memory.
• Research: A-MEM, HippoRAG 2, MemoryOS, M3-Agent for multimodal input, MemRL for self-evolving agents, AgeMem, and Meta's Sparse Memory Finetuning.
• Inside the model: DeepSeek V4 (March 2026) introduced Engram, a hashing-based O(1) memory design that handles a 1M-token context for about the price of 128K and reaches 97% on needle-in-a-haystack tests at that length. The line between memory inside the model and memory in an external store is getting blurry.

Mem0's State of AI Agent Memory 2026 report names the result memory engineering: a production discipline with its own benchmarks, trade-offs and operating habits, following the path prompt engineering took on its way to context engineering. The rest of this piece uses that vocabulary, drawing on the Mem0 ECAI 2025 paper and its April 2026 update, the Zep paper, the LongMemEval and LoCoMo benchmarks, the CoALA framework, the MemGPT and Letta line of work, HippoRAG 2, MemoryOS, M3-Agent, the Claude Managed Agents rollout, AgentCore Memory and OWASP's guidance.

Context windows, RAG and chat logs are not memory

Three mix-ups come up in nearly every "let's add memory" meeting, and they're worth clearing before the architectures make sense.

A context window is not memory. The window is short-lived, volatile and charged again on every turn. Memory persists between sessions and has its own storage tier, evolution rules and forgetting policy. They complement each other, and neither replaces the other. LongMemEval showed that even leading models with million-token windows lose over 30% accuracy when asked to recall facts from earlier sessions without a memory layer.

RAG is not memory. Classic retrieval-augmented generation searches a static corpus, documents that already exist before the agent speaks to anybody. Memory searches the agent's own past: messages, tool calls, facts the user stated, summaries derived from them. The distinguishing feature in 2026 is the write path. A RAG index is mostly append-only and stateless, while memory changes over time, can hold conflicting versions of a fact, has to be corrected when wrong, and is written by the agent itself.

A chat log is not memory. A transcript keeps everything, noise included. Memory should hold extracted facts such as "user prefers metric units", "the Q3 deadline moved to Nov 14" or "the Stripe API key was rotated on 2026-04-12", each with provenance and a validity period, rather than 80,000 tokens of small talk. That compression, done with high recall and published behind an API the agent and the security team can both audit, is the whole job of a memory layer.

All the systems below chase the same goal. The agent should act as if months of shared history exist, yet the bill must stay below a full-context replay, the agent must not invent facts about its user, and nobody should be able to slip bad data into what it recalls.

The shared vocabulary from CoALA

Almost every current framework, whether Mem0, Letta, LangMem, Cognee, Memori or AgentCore, borrows the same taxonomy. It comes from CoALA, the 2023 Princeton and CMU paper on cognitive architectures for language agents, which mapped four types of human memory onto LLM agents:

• Working memory is the active context window, the variables used in the current decision cycle. It's volatile.
• Episodic memory stores specific past experiences with their time and narrative: "the user asked about Stripe webhooks on March 4 and hit error X."
• Semantic memory holds generalized facts: "the user likes terse answers", "ACME's fiscal year ends September 30."
• Procedural memory covers skills, routines and code. It usually lives in model weights, system prompts and tool registries, though a growing number of systems write it at runtime. LangMem maintains a store of prompt rules, and A-MEM keeps an evolving network of notes.

The split matters because each vendor leans differently. Mem0 is mostly semantic. Zep covers episodic and temporal-semantic memory on top of a knowledge graph. Letta supplies a virtual-memory machine spanning all four. LangMem ships separate semantic, episodic and procedural stores. A-MEM blurs episodic and semantic memory through Zettelkasten-style linking, and Memori serializes everything into SQL. Knowing which type a system optimizes for settles half the architecture decision.

Mem0: extract, then update

Mem0 (Y Combinator W24, with $24M raised in October 2025 from Basis Set, Peak XV, GitHub Fund and Kindred Ventures) became the default open-source memory layer in 2026 much as pgvector became the default vector index two years earlier: it handled the dull 80% case in about three lines of Python and held up in production. By mid-2026 it counted more than 41,000 GitHub stars, over 14 million downloads and 80,000 developer sign-ups, with API calls climbing from 35 million in the first quarter of 2025 to 186 million in the third.

The design is intentionally plain. Mem0 sits between the model and a vector store and runs a two-step pipeline on every conversation turn:

1. Extraction. The latest user and assistant exchange, along with earlier context, goes to an LLM extractor that proposes candidate facts. Compression happens here.
2. Update. For each candidate, Mem0 pulls the most similar stored memories and asks the model, through a tool-use prompt, to pick one of ADD (a new fact), UPDATE (augment an existing one), DELETE (the candidate contradicts a stored fact) or NOOP.

What version 3 changed

The v3 algorithm, merged on April 14, 2026, is what turned Mem0 into the standard choice. Three redesigns carry the weight:

• One-pass, add-only extraction. Rather than having the model pick among ADD, UPDATE, DELETE and NOOP on every turn, which means two LLM calls and lots of tokens, v3 makes a single extraction pass that only emits new facts, and treats facts generated by the agent as equal to user-stated ones. Deduplication and entity linking occur afterwards, away from the hot path.
• Multi-signal retrieval. Three scorers run in parallel and merge into one score: dense semantic similarity, BM25 keyword matching and entity matching. The blend adapts to whichever signals exist at query time.
• Entity linking instead of a graph. v3 dropped the Neo4j-based graph variant altogether. Entities are now pulled out with spaCy, with no LLM involved, and stored in a companion {collection}_entities vector collection where each row carries a linked_memory_ids list. That hub-and-spoke layout keeps most of what a graph offered at a fraction of the operating cost.

Reported results:

• LoCoMo: 92.5 overall, with +29.6 on temporal questions and +23.1 on multi-hop questions compared with full context.
• LongMemEval: 94.4 in total, led by +53.6 on single-session assistant questions, +42.1 on temporal reasoning and +16.7 on knowledge updates.
• BEAM at 1M and 10M tokens: 64.1 and 48.6.
• Token cost: about 7,000 per retrieval call against 25,000 or more for full context, a cut near 90%.
• p95 latency: 1.44 seconds against 17.12, a cut near 91%.
• Versus OpenAI Memory: 66.88% against 52.90% on an LLM-as-judge score overall, a 26% relative improvement.

Footprint in production

Mem0's integration documentation lists 21 frameworks and platforms across Python and TypeScript, among them LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen, the Vercel AI SDK, AgentOps and Raycast, along with 20 vector-store backends including Qdrant, Chroma, Weaviate, Pinecone and pgvector. It can also be run as an MCP server, which lets Claude Code, Cursor or any other MCP-capable client talk to it. Voice agents are a natural fit, with dedicated integrations for ElevenLabs Conversational AI (asynchronous addMemories and retrieveMemories tools via function calling), LiveKit and Pipecat.

The most cited customer story is RevisionDojo, an education platform that swapped its full-context personalization stack for Mem0 and reported a 40% drop in token cost together with better personalized learning. Mem0 says thousands of teams, from startups to Fortune 500 companies, run it in production, but few large-company names are public.

Letta: memory as a virtual-memory operating system

Where Mem0 plays the plug-in API, Letta plays the operating system. It was spun out of Berkeley's Sky Computing Lab in 2024 as the production successor to the MemGPT paper (arXiv:2310.08560), and it treats the model's context window as RAM, paging information in and out on purpose. It has three explicit tiers:

• Core memory is the RAM equivalent: a small block that's always in context, holding identity, persona and the state of the active task.
• Recall memory acts like a disk cache: searchable conversation history stored outside the window.
• Archival memory is cold storage: long-term semantic facts the agent writes itself.

Three design choices set Letta apart from everything else on offer.

Self-editing memory. The agent maintains its own memory mid-loop through tools like core_memory_append, archival_memory_insert and memory_replace. There is no separate extractor running in the background. The model decides at reasoning time what deserves keeping.

Sleep-time compute. You can attach a separate sleep-time agent that works asynchronously while the main agent is idle. It reflects on conversation history, derived files and tool traces, and produces a distilled block of learned context that the primary agent loads on its next turn. The sleep-time agent can run a different, usually larger, model than the primary one, so you think cheaply while serving and spend more while consolidating. That is the opposite of how autoregressive inference normally scales, and it echoes how brains fold episodic memories into semantic ones during sleep.

Agent File (.af). Letta open-sourced a serialization format that bundles the system prompt, editable memory blocks, tool code and schemas, and model settings into one file. Such files can be checkpointed, versioned and moved between compatible runtimes, which is the field's nearest equivalent of a Docker image for stateful agents. On export, secrets get stripped out.

Letta Code and its Terminal-Bench score

In late 2025 Letta released Letta Code, an open-source command-line coding agent built on its stateful-agent SDK. The argument is that a session-based tool such as Cursor, Aider or Cline starts from scratch each time, while a stateful agent accumulates knowledge about a project's structure, your preferences, earlier debugging sessions and team conventions. You get one agent per project, and it lives as long as the project does.

The benchmark claim is concrete. On Terminal-Bench, Letta Code ranks first among model-agnostic open-source agents at 42.5% overall (fourth overall, and second among agents driven by Claude 4 Sonnet), and the agent code is under 200 lines on top of the SDK. It switches between Claude, GPT, Gemini, GLM and Kimi with memory intact, the scenario Agent File was designed around.

Zep and Graphiti: a temporal knowledge graph

Mem0 and Letta both treat a vector store as the main substrate. Zep (arXiv:2501.13956) takes the opposite wager and models memory as a temporal knowledge graph. Graphiti, its open-core engine, rests on three layers of subgraph and a bi-temporal model that tracks separately when something happened and when the system found out.

• The episode subgraph keeps raw, high-fidelity inputs (conversation messages, JSON documents, transactional snapshots), each stamped with the time of the original event. It is never rewritten.
• The semantic entity subgraph holds extracted entities and facts, embedded as 1024-dimensional vectors and joined by typed relations. Entities carry validity intervals.
• The community subgraph forms higher-order clusters over the entity layer using label-propagation community detection, which updates incrementally, unlike Leiden.

The bi-temporal model is the part that's hardest to copy with a plain vector store. Every edge in Graphiti carries four timestamps:

t_valid    : when this fact started being true in the world
t_invalid  : when it stopped being true (open if still true)
t'_created : when the system first learned the fact
t'_expired : when the system superseded or removed it

That design lets Zep respond to "what did the agent believe last Tuesday?" just as easily as to "what holds right now?". Compliance teams and anyone defending past agent decisions need exactly that. If a user switches employers the old one isn't erased: the earlier fact is closed with t_invalid, the new one is added, and both remain searchable.

Reported results from the Zep paper: 94.8% on Deep Memory Retrieval against MemGPT's 93.4%; up to 18.5% better accuracy on LongMemEval with roughly 90% lower latency than full context. Independent comparisons put graph-style retrieval, Graphiti included, about 35% ahead in precision of vector-only retrieval on multi-hop relational queries.

More open-source options

These three aren't alone. Several other designs deserve attention.

Cognee

Cognee (around 12,000 GitHub stars by mid-2026) puts a graph, a vector store and a relational store behind a single API. Ingestion runs through a six-stage "cognify" pipeline, followed by a self-refining "memify" pass that prunes stale nodes, reweights edges by how often they're used and adds derived facts. Fourteen retrieval modes are available, running from plain vector similarity up to graph traversal guided by chain of thought, and includes an MCP server.

LangMem

LangChain's SDK offers memory at two integration points: a hot path of synchronous tools the agent calls during a turn, and a background manager that extracts, consolidates and deduplicates asynchronously. It has first-class semantic, episodic and procedural stores, and it is the only major SDK that treats procedural memory, such as "when the user says 'asap', escalate the priority", as a primary feature.

Memori

Memori (Memori Cloud launched on March 2, 2026) writes memory to SQLite or Postgres instead of a vector database. That gives you full data ownership and no new infrastructure, and the project claims an 80% to 98% reduction in inference cost by injecting only the relevant context pulled out with SQL. One line of Python adds persistent memory to an OpenAI, Anthropic or LangChain agent.

A-MEM

A-MEM (NeurIPS 2025, arXiv:2502.12110) turns each memory into an atomic Zettelkasten-style note with structured attributes. A new note links to older ones and updates their attributes in light of the new information, so the network keeps evolving. It is the most "alive" architecture in the research literature, and it beats the state of the art on LoCoMo across six base models.

HippoRAG 2

HippoRAG 2 (ICML 2025, arXiv:2502.14802) extracts open knowledge-graph triples from passages and links synonyms to form what the authors call an artificial hippocampal index. At query time it runs Personalized PageRank outward from seed nodes, imitating hippocampal pattern completion. It reports a 7% gain on associative memory over the strongest dense baselines, and it increasingly serves as the retrieval layer under Zep-style and Cognee-style stacks.

MemoryOS

MemoryOS (EMNLP 2025 Oral, arXiv:2506.06326) is the research cousin of Letta. It formalizes three tiers, short-term, mid-term and long-term personal memory, with explicit transition rules: first-in-first-out from short to mid, and segmented page organization from mid to long. Four modules (storage, updating, retrieval, generation) work across the tiers. On LoCoMo with GPT-4o-mini baselines it posts +48.36% F1 and +46.18% BLEU-1, the largest gain any 2025 paper reported on that benchmark. Expect mid-tier paging to reach production SDKs during 2026.

MemRL

MemRL (January 2026) is the newest direction to watch. It treats memory as a reinforcement-learning substrate. Each interaction is logged as an (Intent, Experience, Utility) triplet, where utility is a learned Q-value for how well that experience served similar intents. A two-phase retrieval surfaces the most useful past experiences for the task at hand, and the Q-values update as the agent runs. The agent's memory gets smarter and not merely bigger, which is about as close to learning from experience as you can get without touching model weights.

SuperLocalMemory

SuperLocalMemory (arXiv:2603.02240) moves the other way, off the cloud and onto the device. This local-first multi-agent system sits on SQLite with FTS5 full-text search, clusters its knowledge graph with Leiden, coordinates through an event-driven layer with per-agent provenance, and defends against poisoning with Bayesian trust scoring, all with no cloud dependency and no LLM call in the retrieval path. Together with the wider SQLite-AI stack, which keeps inference, retrieval, memory, analytics and sync in one file, it is a credible privacy-preserving option for personal agents, regulated workloads and edge deployments.

AgeMem

AgeMem (2026) extends Mem0's four update operations to six tools, namely ADD, UPDATE, DELETE, RETRIEVE, SUMMARY and FILTER, and attaches TTL rules so old memories expire. Its target is something the field only started taking seriously this year: a store that only ever grows ends up poisoning itself.

The hyperscalers move in

The biggest development of 2026 is that the cloud providers stopped watching from the sidelines. All three major ones shipped memory as a first-class product within roughly six months.

AWS Bedrock AgentCore Memory

Introduced at AWS Summit New York in 2025 and hardened steadily through 2026, AgentCore Memory is Amazon's productized version:

• Short-term memory records turn-by-turn state within a session.
• Long-term memory extracts user preferences, key facts and session summaries across sessions automatically.
• Structured episodes (generally available in 2026) capture context, reasoning, actions and outcomes for each episode, so agents can learn from past trajectories and not only from facts.
• Metadata on long-term memory (May 2026) allows tagging, filtering and retrieval by structured attributes next to semantic search.
• Streaming notifications (March 2026) remove the need to poll for memory changes.
• Managed session storage (March 2026 preview) keeps filesystem state when an agent is stopped and resumed.
• Pricing is $0.75 per 1,000 records for memory operations, with extraction inference bundled in. AgentCore Runtime adds $0.0895 per vCPU-hour and $0.00945 per GB-hour, and time spent waiting on I/O is free, which counts because agent workloads spend 30% to 70% of wall-clock time waiting.

Microsoft Foundry user-scoped memory

Microsoft Foundry's persistent memory layer, announced as generally available at Build 2026, has a different shape:

• Per-user partitioning. Each user's memory sits in its own Azure Cosmos DB container, partitioned by identity, so contexts stay separate and are managed one by one.
• Curated, long-lived signals, such as preferences, recurring intent and summarized outcomes, rather than raw transcripts. The transcript remains in the server-side conversation store and only compressed signals become durable memory.
• DevUI, a browser-based local debugger for watching agent execution, memory reads and writes, and orchestration behavior live.
• Evaluation harnesses with tracing, replay testing and automated red-teaming of agent decision paths, which matters because user-scoped memory brings user-specific failure modes.

The bet is clear. Microsoft keeps short-lived session context and durable user memory apart at the storage layer, avoiding the slow rot that sets in when one store has to do both jobs.

Anthropic Claude Managed Agents memory

Anthropic supplies the case study with the largest production numbers of the year. Memory for Claude Managed Agents opened in public beta on April 23, 2026. Persistence takes the form of files in a filesystem that the agent, or you through the API or the Claude Console, can export, edit and manage.

The early adopters' results are unusually concrete:

• Rakuten uses memory so long-running task agents avoid repeating past mistakes, and reports first-pass errors cut by 97%, cost by 27% and latency by 34%, all inside workspace-scoped, observable boundaries. It's the most quoted 2026 figure for memory paying for itself.
• Netflix carries context across sessions, including multi-turn insights and corrections a human reviewer makes mid-conversation, which replaces manual prompt updates.
• Wisedocs runs document verification on Managed Agents and saw 30% faster checks, because memory records which issues recur in which templates, letting the agent skip redundant re-analysis.
• Ando uses memory across sessions inside a financial workflow with many steps.

Anthropic also previewed a research feature called dreaming: an offline reflection process in which managed agents replay past task outcomes to extract lasting lessons. It's the same idea as Letta's sleep-time compute, productized at hyperscaler scale.

What ties the three offerings together is that memory has stopped being an SDK choice and become a platform feature. That changes the position of the open-source vendors, since Mem0, Letta and Zep now compete with the cloud each customer already uses. Their arguments move toward portability (Agent File), specialization (Zep's bi-temporal model) and cost (Memori's SQL-native pitch).

Memory that sees and hears

All of the systems above assume memory is text. During 2026 that assumption broke, and the second half of the year saw image, video and voice memory grow into a research front of its own.

M3-Agent from ByteDance Seed (arXiv:2508.09736) is the leading reference design. It takes in live visual and auditory input and builds an entity-centric multimodal memory graph: each person, object or place becomes a node, and the agent ties face IDs and voice IDs back to the same node. That makes questions such as "what did the man beside Sarah say about the project last week?" answerable, which a store built from text alone can't do. It runs two processes. A memorization loop continuously pulls faces, voices and semantic facts out of streaming audio and video into the graph, and a separate control loop reasons over the graph to answer questions.

To test this class of system the team released M3-Bench, with 100 newly recorded robot-perspective videos and 929 web-sourced ones across varied scenarios, with question-answer pairs probing human understanding, general-knowledge extraction and cross-modal reasoning. M3-Agent beats the strongest vision-language baselines (Gemini 1.5 Pro and GPT-4o), with margins of 6.7, 7.7 and 5.3 points on M3-Bench-robot, M3-Bench-web and VideoMME-long respectively.

Related work is piling up. M2A offers dual-layer hybrid memory for personalized multimodal interaction. VideoAgent keeps general event descriptions together with tracked object states, and WorldMM layers episodic, semantic and visual memories over video streams. Mem-Gallery (arXiv:2601.03515) is a benchmark made to measure how memory is preserved, organized and evolved across long multimodal conversations.

The practical stakes are simple. A webcam, a shared screen, a voice line or a document full of figures gives an agent signal that a text-only store simply drops. Within a year or so the big SDKs should offer multimodal memory building blocks, and the entity-centric graph from M3-Agent looks like the safest bet to become the template.

What the benchmarks measure

Four benchmarks anchor most comparisons.

• LongMemEval (NeurIPS 2024, arXiv:2410.10813) has 500 questions across five abilities, placed inside chat histories of varying length: roughly 115K tokens for the S variant and about 1.5M tokens across 500 sessions for the M variant. Its headline finding is that commercial assistants lose 30% accuracy on cross-session memory, and up to 60% on the hardest categories.
• LoCoMo (ACL 2024) focuses on long conversations with hard time-based and multi-hop questions. Mem0 claims +29.6 on the temporal side and +23.1 on multi-hop, while MemoryOS claims +48.36% F1 over GPT-4o-mini baselines.
• Deep Memory Retrieval comes from the MemGPT work. Zep scores 94.8% against MemGPT's 93.4%.
• M3-Bench is the first serious multimodal long-term memory benchmark, using robot and web video. M3-Agent leads by 5 to 8 points over Gemini 1.5 Pro and GPT-4o.

Several newer ones now count too. BEAM probes memory at 1M and 10M tokens, where Mem0 v3 scores 64.1 and 48.6. Context-Bench from Letta (2026) evaluates agentic context engineering, meaning whether a model knows what to place in its own context and when. MemoryAgentBench (ICLR 2026, arXiv:2507.05257) is the most important new entrant. Its recipe is to inject a document once and then query it repeatedly: long texts are sliced into chunks of 512 or 4,096 tokens and fed in as a multi-turn exchange. Two purpose-built datasets, EventQA and FactConsolidation, check retrieval, learning at test time and the handling of conflicting facts. MemBench (arXiv:2506.21605) adds another axis by grading agents on effectiveness, efficiency and capacity, and separately scoring factual and reflective memory, and participating versus merely observing. By the end of 2026 these two will probably be the default way to ask what a memory system truly does, the role LongMemEval played for chat in 2025.

A caution: every vendor benchmarks on whichever configuration flatters its architecture, so read the category breakdowns instead of the headline. In production, token cost and latency count for as much as accuracy. Replaying everything is a legitimate baseline, and any memory layer that can't beat it on both axes at once should be embarrassed. By 2026 all the major systems clear that bar.

How the designs compare

Taken property by property:

• Substrate. Mem0 uses a vector store with entity hub-and-spoke links. Letta uses a tiered virtual-memory hierarchy, Zep a temporal knowledge graph on Neo4j, Cognee a unified graph, vector and relational store, and Memori SQL. AgentCore is managed inside Bedrock, Microsoft Foundry uses user-partitioned Cosmos DB, and Anthropic's Managed Agents use a filesystem.
• Memory types served. Mem0 covers semantic memory and entities. Letta covers all four CoALA types. Zep handles episodic, temporal-semantic and community memory. LangMem has semantic, episodic and procedural stores, Memori semantic and episodic memory in SQL, AgentCore structured episodes, and Foundry only long-lived signals.
• Write path. Mem0 v3 does single-pass extraction with downstream deduplication. Letta edits memory inside the loop and consolidates during sleep time. Zep writes bi-temporal edges, AgentCore bundles extraction inference into its price, and Foundry curates signals while raw text stays in the conversation store.
• Temporal reasoning. Mem0 keeps timestamp metadata. Letta has archival timestamps plus sleep-time processing. Zep is natively bi-temporal and leads the industry here. AgentCore tags long-term memory with metadata and Foundry handles time implicitly through signal types.
• Retrieval signals. Mem0 fuses semantic, BM25 and entity scores. Zep combines graph traversal, vectors, BM25 and time. Cognee offers 14 modes, and Memori relies on SQL queries.
• Portability. Letta has the open .af standard and Anthropic allows filesystem export. Others offer vendor-specific dumps.
• Best fit. Mem0 suits drop-in personalization, voice agents and consumer apps. Letta suits long-running, OS-style agents and coding agents. Zep targets regulated enterprises that need auditing, Cognee research and development teams who want graph control, and Memori small teams who prefer SQL. AgentCore fits AWS shops, Foundry fits Microsoft shops, and Claude Managed Agents fit anyone already on the Claude Platform.
• Headline proof point. Mem0: 94.4 on LongMemEval. Zep: 94.8% on DMR. MemoryOS: +48.36% F1 on LoCoMo. Letta Code: 42.5% on Terminal-Bench, first among open-source agents. HippoRAG 2: +7% on associative memory. Anthropic with Rakuten: 97% fewer first-pass errors, 27% lower cost and 34% lower latency. M3-Agent: 5 to 8 points over vision-language baselines on multimodal benchmarks.

When memory became an attack surface

In May 2026, agent memory stopped being only an accuracy and cost matter and became a security one.

The warning signs came earlier in the year. Microsoft Security wrote about "AI Recommendation Poisoning", the practice of manipulating an assistant's memory for profit, in February 2026. Radware followed with a proof of concept dubbed ZombieAgent: a booby-trapped file in an email plants a memory in a ChatGPT agent wired to the victim's mailbox, after which every interaction fires the poisoned entry and leaks data through URL-encoded side channels. One enterprise scenario on record had a hijacked financial-analysis agent accept a tainted intermediate result and start a workflow that moved funds without authorization before a person reviewed any of it.

Poisoning memory is a different animal from ordinary prompt injection, for three reasons:

• Persistence. Prompt injection corrupts one response. A poisoned memory corrupts every later response that touches the affected key.
• It hides well. A poisoned entry looks just like honest stored context.
• Autonomy. Agents act on memory through tool calls, so a poisoned memory can cause real-world side effects without any human in the loop.

The defense arrived fast. OWASP added memory poisoning to its 2026 Top 10 for Agentic Applications as ASI06 (Memory and Context Poisoning) and released the Agent Memory Guard reference implementation in mid-2026:

• SHA-256 baselines on immutable memory keys such as identity.user_id, so any out-of-band tampering gets flagged.
• YAML security policies that map detections (injection attempts, sensitive-data leakage, changes to protected keys, rapid changes, size anomalies) to actions: allow, redact, quarantine or block.
• A roadmap to v0.4.0 (Q3 2026) with ML-based anomaly detection, vector-store protection and a live monitoring dashboard.

A reasonable floor for any memory deployment this year includes TTLs, validity windows, provenance recorded on every write, cryptographic baselines for identity keys, regular adversarial testing, and a human approval step ahead of any tool call driven by memory that touches money or sensitive data. The reference paper on attacks and defenses is arXiv:2601.05504, and Microsoft's Agent Governance Toolkit now includes explicit ASI06 mitigations.

Problems nobody has solved

Even with the security stack in place, much is still open:

• Stale memory. A fact that's correct today becomes confidently wrong tomorrow, and append-only stores rot. TTLs and validity intervals are the remedy, though they aren't yet the default.
• Identity across sessions. Deciding whether two sessions involve the same person or the same project is the thorniest unsolved sub-problem, particularly in a multi-tenant Mem0 namespace with thousands of identities.
• A retrieval ceiling. Accuracy peaks at three to five retrieved memory chunks and then declines. Fusing vector, keyword, entity and recency signals is the production baseline, which is why Mem0 v3 went multi-signal.
• Cost accounting. "Memory saves tokens" holds only when the extract-and-update LLM calls cost less than the context tokens they avoid. For low-volume agents the math sometimes flips, so cost per successful outcome is the only honest figure.
• Misclassified hierarchy. The 2026 xMemory study found that 44.91% of memories get reassigned between hierarchy levels in a running system, showing that flat or one-shot classification fails. Systems that reclassify, such as A-MEM, Cognee's memify, Letta's sleep-time agents and MemoryOS mid-tier paging, are early winners.
• Thin evaluation. LongMemEval and LoCoMo are solid yet text-only and conversation-shaped. M3-Bench and Mem-Gallery stretch into multimodal territory, while Context-Bench and Terminal-Bench stretch to tool-using agents. Nobody has yet built a single test for the full agent surface.
• A blurring line between hyperscalers and open source. Rakuten's 97% figure on Anthropic Managed Agents puts pressure on every open-source vendor to show a comparable return.

Picking by situation

A practical cheat sheet for 2026:

• Consumer personalization and voice agents: Mem0. It drops in quickly, with mature SDKs across 13 frameworks, 20 vector stores and 3 voice platforms.
• Long-running personal agents and coaches: Letta. The OS hierarchy and sleep-time compute map neatly to multi-week tasks.
• Coding agents over a private codebase: Letta Code, with one stateful agent per project.
• Regulated enterprises that need auditing: Zep with Graphiti. The bi-temporal model is the standout feature.
• Research and development teams that want graph control: Cognee, or HippoRAG 2 underneath.
• Teams already on LangGraph: LangMem, with the lowest integration cost and the only first-class procedural memory.
• Teams that simply want SQL: Memori.
• AWS shops: Bedrock AgentCore Memory, with pay-as-you-go pricing, generally available episodes and streaming notifications.
• Microsoft shops: Azure AI Foundry's user-scoped memory, with Cosmos DB partitioning, DevUI debugging and built-in evals.
• Teams on the Claude Platform: Claude Managed Agents memory, portable as files and carrying the strongest published customer return of 2026.
• Multimodal agents with vision or voice: the M3-Agent pattern of an entity-centric graph linking face and voice IDs. No production SDK exists yet, so you build it.
• High-trust regulated work in law, healthcare or finance: Zep or Cognee, plus OWASP Agent Memory Guard policies, TTLs and an audit trail. Never an append-only store.

Where memory goes next

Looking through the rest of 2026 and into 2027, several trends stand out.

• Memory moves into the architecture. DeepSeek V4's Engram is the leading data point: hashing-based O(1) retrieval that handles 1M tokens for about the cost of 128K and reaches 97% on needle-in-a-haystack tests at that scale. A dual-pathway design separates static knowledge retrieval from dynamic working-memory compute, the nearest any frontier model has come to treating memory as an architectural element and not a context-window hack.
• Memory and continual learning converge. Meta's Sparse Memory Finetuning paper (arXiv:2510.15103) found that learning new facts through memory layers degrades held-out task performance by only 11%, against 89% for full fine-tuning and 71% for LoRA. That dissolves the wall between an external memory layer and parameter-internal memory. Frontier models in 2027 may include native sparse-memory layers acting as a low-forgetting route from an agent's memory store into model weights.
• Memory as an RL substrate. MemRL's logging of intent, experience and utility, with Q-values updated from outcomes, turns recall into a policy-improvement signal. Production SDKs will likely adopt it by late 2026 under a name like outcome-weighted retrieval.
• Retrieval and memory unify. HippoRAG 2, A-MEM, MemoryOS and Mem0's entity-linked store all treat an agent's history as one more corpus over a graph. Future stacks will expose a single retrieval API across documents and agent memory with a shared hybrid backend.
• Sleep-time consolidation becomes standard. Letta's sleep-time agents, Anthropic's dreaming and MemoryOS's segmented paging share one idea: offline reflection that converts transient episodic traces into durable semantic knowledge. Expect every major framework to ship its own version by the end of 2026.
• Multimodal memory in the SDKs. Benchmarks like Mem-Gallery and M3-Bench push in this direction. M3-Agent's graph is the design most likely to appear in Mem0, Letta or Zep by 2027.
• Governance turns into regulation. After ZombieAgent and ASI06, audit logs, retention rules and consented forgetting will be requirements of the product, and auditors working to SOC 2 and ISO 42001 will begin asking directly about memory hygiene.
• Procedural memory takes off. Most work so far has been semantic and episodic. LangMem's procedural store, A-MEM's evolving notes, Letta's self-edited core and Anthropic's dreaming all point to a bigger prize: agents that update their own behavior and not just their own facts.
• Shared memory across agents. Teams of agents working as a swarm need a pool that every member can read and write, since private per-agent stores don't cut it. A blackboard with handoff protocols and a clear split between real-time memory for the current execution and persistent memory across executions. Mem0's multi-tenant APIs, Letta's shared archival store, Agent File portability and research such as SRMT for multi-agent pathfinding are early steps.
• Private, local memory. SuperLocalMemory and SQLite-AI show a credible alternative to cloud-only designs: SQLite, FTS5, Bayesian trust scoring and Leiden clustering, all on the device, with no LLM inference in the retrieval path. Apple, Google and Microsoft each work on agent runtimes at the OS level that keep memory local first, and SQL-native designs such as Memori and Mem0-style extraction pipelines should reach mobile SDKs by late 2026.
• Memory engineer becomes a job title. Mem0's report frames memory engineering as a discipline alongside prompt and context engineering, with four memory scopes (user, agent, team and workflow), each with different owners, retention rules and risk profiles. Expect the role to appear in AI infrastructure hiring by 2027.

The practical takeaway

Through most of the LLM era memory was a patch job: a concealed system prompt, RAG over old chats, or a million-token window costing $5 a request that still misses the answer. In 2026 it became a proper layer with vendors, cloud products, benchmarks, write paths, a security model and failure modes of its own.

If your agent still asks for the user's name on Monday, you're giving up more than accuracy. You keep paying for full context and get results that a 7,000-token memory lookup would beat, and you're leaving an unmanaged attack surface open, while competitors on Mem0 v3, Letta sleep-time agents, Zep's temporal graph, AgentCore, Foundry's Cosmos-partitioned memory or Claude Managed Agents are already counting savings. Rakuten's 97% / 27% / 34% combination is the new reference for memory paying for itself, and RevisionDojo's 40% token cut is the small-team version. M3-Agent shows the way through vision and voice, OWASP Agent Memory Guard supplies the seatbelt, and Meta's Sparse Memory Finetuning hints at how memory and weights will eventually merge.

The next year of agent design won't hinge on new base models. It will hinge on treating memory as a system: written, evaluated, governed, defended, consolidated and improved like any other piece of production software. The agents that win won't be the ones with the biggest windows. They'll be the ones that actually remember, remember across modalities, and remember safely.