Acme was never a sponsor

The topic file said "Considering inviting Acme as a sponsor. Not decided." The speaker confirmation email said "You will be appearing alongside sponsor Acme."

Nobody invented that. I wrote the wrapper that turned the first sentence into the second, and I wrote it to do exactly what it did: copy every fact in the memory pack into fluent prose. Acme was in the pack. So Acme went to the speakers, with a date that was correct and a company name that was correct, in an email that looked finished.

The pack was there because a colleague asked me, on Wednesday morning, whether they should just leave it on. On Tuesday Anthropic joined the memory you build in Claude's chat to Claude Cowork, the agent that writes docs, budgets, and logistics. This morning the company made Claude in Chrome generally available on paid plans, with actions the agent takes without asking you every time. The implied default is easy to hear. Memory on. The agent already knows you. Stop re-explaining. A week ago I would have said the same thing.

So I spent the day on it. I read Anthropic's 25 August post, TechCrunch and The Register from the same day, and the Chrome note from this morning. Then I packed one Northwind chat log six ways and handed each pack to three Cowork-style tasks: a manager update, an ops one-pager, and a speaker confirmation email. No model API; an extractive wrapper that copies every fact sitting in the pack. The topic files, the live-update, and the arithmetic are in the prototype repository. I did not run Cowork, ChatGPT agent mode, or Claude in Chrome on a live account, so anything I say about what those products would write is marked as a guess; I am not ranking Claude memory against ChatGPT against Gemini; and prompt injection gets its own article, even though Chrome's launch is mostly about injection and a memory file now sits next to an agent that can click.

Prune was the only pack I would have sent

On 26 August 2026 I compared six memory policies: paused, the old chat-only split, unified with a stale store, unified after a live update, unified then pruned by hand, and live-update with sensitive topics switched on. Paused and split asked for a re-brief. The stale store shipped the old company name and the old date. The live update fixed both of those and still sent 120 people, $45,000, and Acme to the speakers. Pruning the topic files down to current facts was the only policy whose three drafts I would have let leave the building.

My default for the colleague, then:

1. Leave shared memory on for anything you would put in a team brief.
2. Before Cowork or a browser agent writes something another person will read, open Settings, Memory, and delete every topic you would not paste into that task.
3. Do not count the live update, or the sensitive-topics toggle, as having done step two. Neither one looks at the list.

Two caveats ride along. A live model might drop Acme where my wrapper kept it, and it might invent a fifth fact my harness cannot show. And Claude Code's memory is still separate, so none of this transfers there.

Which remembered facts go with the speaker email?

All of them that survive packing, and in my store that included two nobody ever decided. The question the colleague was really asking was not "is memory good now" but "when Cowork drafts the email, which of my remembered facts go with it, and did I mean them to?"

Think about what you already tell a chatbot about work. Manager preferences. A conference that keeps moving. A budget you would never put in a speaker email. A "what if we invited them" that was a thought, not a decision. Once a year a product joins that pile to an agent that can act, and the natural move is to leave the toggle where it landed, because re-explaining felt like the bug they just fixed. Re-explaining was the bug in chat. Cowork is a different job.

The narrower question I could actually test: if I leave a months-old chat store unified with an agent, do the drafts stay inside the facts I would defend, or do stale numbers and undecided asides still ship?

One store, two jobs

I had assumed "memory" was one product. The Register's 25 August piece is what changed that for me. Cowork runs tasks, including in the cloud, and Anthropic told them there is no option to keep chat memory and Cowork memory apart. Different accounts, pause, incognito, or prune. Those are the splits you get. Claude Code stays out of the join, for now.

My read now is that it is two jobs sharing a store. Continuity in chat is one. An input to an agent that can email speakers is another. Tuesday's update fused them on purpose, and I think the honest way to read the setting is as an agent input, not as a diary.

Chrome this morning makes the same fusion louder. The agent can now act in the browser without a click on every step, behind a classifier that checks the action against your original request. Anthropic reports that with probes plus that classifier, no attack succeeded against Claude Sonnet 5 or Opus 5 on their current prompt-injection eval, and 0.3% succeeded against Fable 5, vendor-run. I am not going to rerun that eval. What I would say is that the topic list got more expensive today regardless: a memory file now sits next to an agent that can type into pages you are already logged into, even if you never install the extension.

Anthropic's post, The Register's question, and a sleeper paper

There is no public index for "whose memory is safest". What exists this week is a vendor post, a couple of independent write-ups of that post, and a research line on memory as an attack surface. I keep them in separate piles below, and I would ask you to as well.

A launch post is a convenience claim, not a measurement of what an agent will write. I stole its conference example for the trial, because it is the example they want you to want: brainstorm the agenda in chat, then let Cowork build the logistics doc from headcount, city, and speakers.

I am glad someone asked about Code, because I nearly wrote this piece as if "Claude" were one memory. If your job this week is a coding agent, Tuesday's join does not apply to you, and I would rather say that here than have anyone route a default off a Cowork screenshot.

That paper is adversarial, it is a preprint, and it is not my trial. A May sleeper-poisoning rate says nothing directly about a Northwind speaker email. Where I think it matters is the mechanism: a stored topic is later treated as trusted context. If a planted memory can steer an agent months later, a brainstorm you forgot you had can too. The only difference is who wrote the file.

On what is described this week, I'd say Claude's topic files are the more inspectable of the two. ChatGPT still has a wall the new Claude join lacks: you can keep a project from seeing the rest of your life. If the job is an agent that sends, I would take that wall over a prettier file list.

The later chat never heard about July

Anthropic now writes topics as you talk instead of summarising when the thread ends. Mention that the deadline moved to September and the next conversation already knows. I used that feature and it worked. In my store the later chat restated two facts: the date became 8 September 2026, and Northwind Analytics became Northwind Labs. Both landed in the file.

The headcount had dropped to 80 in July. I never said so in the later chat, so the file still said 120, and 120 went into every unpruned draft. The live update is a patch on the fields you happened to mention. If you read "memory updates as you chat" as "the store is current", you have already left the job, and until Wednesday I had.

The sensitive-topics toggle never saw Acme

Sensitive topics are off by default: health, race, ethnicity, beliefs, politics, gender identity. You can turn them on, with a notice each time something in that bucket is saved. Identification numbers, criminal history, and immigration status stay out even then. A useful filter, and a different filter from "would I paste this into a speaker email".

Acme was a brainstorm. $45,000 was an internal ceiling, labelled in the store as "do not share with vendors or speakers". Neither is a sensitive topic, so the default-off toggle has no reason to catch them, and it did not. I walked in expecting the privacy control to be the story. The story was the brainstorm.

Anthropic's post is not misleading on its own terms. Less re-explaining is a real gain, editable topic files are a real control, sensitive-off is a real default. Quote any of the three as "so leave it on for Cowork" and you have mixed a chat job with an agent job. The column the product page cannot have is "what in this store would I paste into a speaker email". Only you can fill that column, and the relief of not rebriefing is exactly what stops you from opening Settings to do it.

Six packs, three drafts, one gate written first

I wanted a test a regular reader would recognise as a week of chat, not as a benchmark.

Gold, fixed in data/gold.json before I wrapped anything:

• Company: Northwind Labs
• City: Austin
• Date: 8 September 2026
• Headcount: 80
• Speakers: Maya Chen, Omar Diallo
• Manager: Priya Shah

Forbidden if they appear in an agent draft: Northwind Analytics, 12 August 2026, 120, $45,000, Acme, gluten.

Six policies: paused, split (chat remembers, Cowork sees nothing), unified with the stale store, unified after the 25 August live-update, unified then pruned to current gold topics, and live-update with sensitive topics on. Three tasks each. The reader is extractive, and the reader is not Claude. If a forbidden fact is in the outbound text, a better model doesn't get a vote; the pack already voted.

What I expected, written down beforehand: paused would be incomplete, stale would be dirty, and live-update would save the email, because saving the email is the feature they shipped. I was wrong about live-update, and that miss is the article.

The email that knew the new date and the old room

The stop threshold fired on the speaker email.

What killed my working default was the shape of the failure, not the fact of it. I had assumed restating the date and the rebrand was how grown-ups keep memory current, and the later chat did exactly what Anthropic describes: mention the deadline, and the next pack knows. The headcount file never heard about July, and 120 people left in a complete email. I am not surprised that something went stale; I had bet on a stale date or a re-brief. What surprised me was a finished-looking message with the wrong room size, because nothing about it asked to be checked.

The third result surprised me in the way I should have seen coming. I had treated the sensitive-topics toggle as the load-bearing control. Turning it on leaked gluten into the speaker email, a catering constraint the speakers never asked about. Turning it off, the default, left Acme and the budget in place. The privacy control worked on the bucket it names. The sendable-draft failure was in a different bucket, because "not decided" is not a sensitive topic.

Not decided, rendered as confirmed

The Acme line is the one I designed, and reading it in the draft still caught me off guard. The topic file said "Considering inviting Acme as a sponsor. Not decided." The wrapper rendered "You will be appearing alongside sponsor Acme." I should say plainly what that proves and what it does not. I wrote the wrapper to copy every fact in the pack into fluent prose, and "Acme" is a fact in the pack. A live model might keep the hedge. It might also drop the hedge, because "confirmed sponsor" is how a logistics doc sounds when it wants to sound informed. The trial defends the narrower claim: once the name is in the pack, it is available to the draft, and my wrapper used it. I would not bet a speaker email on the model declining.

Four places my own table would fool a regular user

Complete drafts look like work

The live-update email had every required fact, and that is the dangerous row. Incomplete drafts ask you to re-explain. Complete dirty drafts look finished. I used to score memory on whether the agent still knew the date. Knowing the date is the wrong passing grade for anything a speaker will read.

A patch on the fields you mentioned

A later chat patches what you said. It does not walk the topic list and ask "is 120 still true". Change a number in the world and never say it in the window, and the file keeps the old one. I had assumed the new writer was a janitor. My impression now is that it is a stenographer with a shorter delay.

Health and beliefs, not budgets

The sensitive-topics list is worth having. It will not catch a sponsor brainstorm, an internal ceiling, or a headcount you outgrew. If your kill switch is "I left the sensitive toggle off", you have protected a different job from the one Cowork is about to do.

Code, Team, and ChatGPT each start somewhere else

Claude Code is still separate. Team and Enterprise start off. Consumers start on. ChatGPT still has Temporary Chat and project-only memory. Copy a default across those walls and you will be right about none of them. I almost wrote this piece as if Tuesday applied to every Claude surface, and The Register is the reason I didn't.

What I told the colleague on Wednesday

The average says the setting is usable if you prune. The binding constraint says don't let a July aside pick the sponsor the speakers see. Chat can stay messy. The agent path is a short list of facts you would defend, plus one look at the topic files before you hand over the task.

Replay the Northwind store without a key

You can rerun the recorded trial with no API key. You still need your own topic list if you want to choose a default for yourself.

git clone https://github.com/shravan1996/generative-ai-memory-is-not-a-brief
cd generative-ai-memory-is-not-a-brief
python3 -m unittest discover -s tests
python3 eval.py

No network, no GPU, no third-party package. The full implementation is in the prototype repository.

1. 01

   Open Settings, Memory, and read the topic files out loud

   Owner

   You

   Artifact

   The list of what the agent can see this week

   Signal

   If you have not opened it since Tuesday, you are using the default, not a brief

2. 02

   Mark each file as current decision, stale, brainstorm, or internal-only

   Owner

   You

   Artifact

   Four piles, written down before the next Cowork task

   Signal

   A file you cannot pile is the one that will surprise you

3. 03

   Delete or edit anything you would not paste into an email

   Owner

   You

   Artifact

   A shorter topic list a colleague could defend

   Signal

   If the list did not shrink, you have not pruned

4. 04

   Run the next agent draft against that list, or through this repo with your files swapped in

   Owner

   You

   Artifact

   Sendable, or a re-brief

   Signal

   A complete email with a remembered aside is a skip

5. 05

   Keep memory on for chat, or pause it for the next brainstorm

   Owner

   You

   Artifact

   A one-line default and a date to look again

   Signal

   If a speaker or a vendor sees a chat aside, the toggle doesn't get a vote

Before any agent draft leaves the building:

• Topic files are opened before any Cowork or browser-agent task that leaves the building
• Brainstorms and internal numbers are absent from that pack
• A draft cannot be sent if a forbidden aside is in it

Turn the default off and start again if:

• A week of real agent drafts contains a fact that was only in chat as thinking-out-loud
• The team is treating live-update as a review of the store
• You needed the sensitive-topics toggle to catch a sponsor or a budget

Should you leave shared memory on this week?

Yes for chat. Not as the brief for an agent that emails, publishes, or fills a form, unless you have opened the topic list and deleted anything you would not paste into that task.

Prune first, then let the agent draft

Split for shared memory into Cowork in the last week of August 2026.

As far as I can tell, the brief is the short list of current facts you would defend, plus the look at the topic files before the agent runs, and the shared store on its own is neither of those. I would start a colleague on prune-then-Cowork. I would still leave memory on for the chat they would not send. I wouldn't treat live-update as a janitor, and I wouldn't treat sensitive-off as a send gate. I expect Claude, ChatGPT, and Gemini can all draft behind that prune; the pack decides, not the logo.

I would change this verdict if:

1. Your live Cowork, on three real topic stores that still contain a labelled "not decided" aside, never puts that aside in an outbound draft, and you can show the topic files next to the emails.
2. Live-update, on a store whose headcount changed in the world and was never restated in chat, still drops the old number. I have not seen that writer.
3. Anthropic ships a chat-only / Cowork-only split, the way ChatGPT still has project-only memory, and you can keep brainstorms out of the agent without pruning by hand.

What outlasts this week's toggle

A live Cowork that declines to call Acme a sponsor is the thing I most want to be shown. If yours did, with a "not decided" aside still sitting in the topic list, show me the draft. Until then the prune is the default, and I will keep saying so to the colleague who asked.

Acknowledgements

This article builds on Anthropic's 25 August memory post, the TechCrunch and Register write-ups the same day, and the sleeper-memory paper linked below. The Register is why Claude Code is not in the default.

References

Independent boards

• Hidden in Memory: Sleeper Memory Poisoning in LLM Agents. Pulipaka, Hlebik, Raghav, Abdelnabi, Raina, Sheth, and Fritz. Preprint, 14 May 2026. Injection up to 99.8% on GPT-5.5; agentic use of retrieved poisons 60 to 89%.
• A Practical Memory Injection Attack against LLM Agents. MINJA. 2025. Memory poisoning through ordinary queries, without direct write access to the store. Cited as the earlier attack shape, not scored in my trial.
• Claude Cowork finally remembers what you told the app in chat. Sarah Perez, TechCrunch, 25 August 2026.
• Claude and Cowork now share what they know about you. The Register, 25 August 2026. Claude Code stays separate; no chat/Cowork split except different accounts.

Vendor posts

• Claude's memory works everywhere, and you decide what's in it. Anthropic, 25 August 2026. Unified chat and Cowork memory; live topic writes; sensitive-off default.
• Claude in Chrome is generally available. Anthropic, 26 August 2026. Autonomous browser actions on paid plans; vendor prompt-injection numbers cited above.
• Memory FAQ. OpenAI. Temporary Chat, memory summary limits, rebuild-from-history. Checked 2026-08-26.
• ChatGPT release notes, memory. Project-only versus default memory. Checked 2026-08-26.

This trial

• Source, topic files, policies, and gate
• Exact tested commit
• Northwind Summit store, 26 August 2026. Gold: Labs, Austin, 8 September 2026, 80 people. Extractive gate, no model API.

Sources last checked: 2026-08-26