Should an AI agent be allowed to write its own memory?

Yes, but not with a blank check: what it may save without asking depends on what the fact is and where it came from. Microsoft’s own guidance for agentic memory gates each write before it lands, not after: is the caller authorized to write here, and did the user intend this fact remembered, rather than letting an email or a web page create it on its own. Preferences and task context pass with standard safeguards; credentials, payment details, and government IDs are blocked outright regardless of source; and a sensitive attribute like health or politics is added only if the user stated it themselves, never inferred on the agent’s own initiative.

That authorization check matters even when the agent behaves well. Zenity Labs found an Amazon Bedrock agent whose over-broad execution-role permissions let an attacker plant instructions in its memory that survived the original compromise, a failure of who’s allowed to write, not what the agent chose to write. And even where a model resists writing untrusted content into memory directly, a payload already planted there can still shape later sessions, though persistence varies a lot by system and model rather than being constant.