The unsigned memory problem

An AI agent's memory today is a claim you have to take on faith.

You can sometimes move it. You can sometimes see who inside the vendor's system touched it. You can almost always delete it through the vendor's API. What you can never do is hand a memory to a different agent, a counterparty, or an auditor and have them confirm, without trusting the store it came from, that it is authentic, unaltered, and authored by who it claims.

We read six systems to check that claim. It held. This essay is the argument behind the numbers; the full matrix, the citations, and the method live in the State of Agent Memory report. The short version: the one capability that would let memory function as a credential rather than a convenience is shipped by exactly none of them.

What agent memory actually is

Strip away the product names and agent memory is a simple idea with a heavy consequence. It is the store of facts an agent accumulates about you, your account, your preferences, and your past decisions, so that the next conversation does not start from zero. The customer it knows. The budget you set. The merchant you approved last week. The dispute you raised the week before. As agents start to transact, that store stops being a convenience feature and starts being the thing a counterparty would want to rely on.

That is the tension. A memory you keep to yourself can be a private scratchpad with no guarantees. A memory you want another party to act on has to carry proof. The moment an agent says "my principal authorized this, here is the record," the record stops being a note and becomes a credential. And a credential that cannot be checked is not a credential. It is an assertion.

The systems we read

We assessed six systems spanning the live landscape: Letta (formerly MemGPT), Mem0, Zep, LangMem, the model-native memory of ChatGPT, Claude, and Gemini, and Cognee. Three open or self-hostable frameworks, two memory-as-a-service products, and the memory features built into the three most-used assistants. Each was read against six dimensions: storage model, portability, provenance, consent and control, verifiability, and standards or interop.

The reads were firsthand, drawn from official documentation, public source code, and API references, then handed to an independent reviewer told to refute the high-stakes claims by reading the cited sources again. The disclosure is the method. Anyone can argue with a cell.

Four counts carry the whole argument.

Zero of six sign memory. Zero of six export it at full fidelity. Zero of six carry portable provenance. Three of six ship regulatory-grade consent.

Zero of six sign memory

This is the crux, and it survived adversarial review across all six. There is no cryptographic signature, content-binding hash chain, Merkle structure, or append-only tamper-evident log on any memory record in any of the systems we read. Not one.

The things that look like integrity are not. Letta's version column is optimistic locking: it guards against two writers clobbering each other inside Letta's own database, not against forgery, and the import path performs no signature validation. Mem0's hash is a content hash for deduplication, and Mem0's own security writing lists per-entry cryptographic hashes as aspirational best practice, which confirms it is not shipped. Zep's "verified: true" is a metadata tag a user can set by hand, not an attestation. Cognee's source_content_hash detects whether source content changed but is not bound to an author key. Model-native memory is encrypted at rest, which is confidentiality, not integrity.

The consequence is the same in every case. A compromised store, or simply a dishonest one, could rewrite a memory and no recipient could tell. Once a memory leaves the database it came from, there is nothing to check it against except your trust in the database.

Exportable, but not portable

Several systems can get bytes out. None gets trustworthy, complete memory out. The distinction matters because portability without the provenance and the full record is not portability. It is a copy you still have to take on trust.

Letta's Agent File is the strongest case and still falls short. It is round-trippable JSON, Letta to Letta, but the format's own roadmap lists archival passages and cross-framework converters as unchecked, and the docs state the archival store is not currently included. So the searchable long-term memory, the part that matters for commerce, does not travel. Mem0's export is a schema-reshaping summary with no documented import endpoint. Zep's cloud product has no bulk-export endpoint at all. Claude and Gemini offer manual plaintext copy-paste, flagged experimental. In every one of these paths, the provenance metadata does not ride along, so what you receive is text with no verifiable origin.

Provenance that answers the wrong question

Four of the six record some lineage, but it is the wrong kind. Where provenance exists, it lives in the operator's database and answers "which pipeline or source," not "which agent authored this fact." And it cannot be checked by anyone who does not already trust the store.

Letta stamps org, user, and agent ids with timestamps, but those are internal ids, not cryptographic origin, and none of them appear in the exported schema. Mem0's actor_id is real but developer-supplied per message rather than captured automatically. Zep traces every fact to its source episode with bitemporal stamps, which is genuinely strong on data origin, yet its edge schema has no authorship field at all. The pattern is consistent: lineage that is asserted by the store, scoped to data origin rather than authorship, and stripped at the boundary when the memory leaves.

The one thing the market got right

Consent is the lone strength. The model-native trio, ChatGPT, Claude, and Gemini, all let you view, edit, delete, and disable memory with regulatory-grade deletion language. Mem0, Zep, and Cognee ship GDPR Article 17 style cascade deletion. Three of six reach a mature bar, and most of the rest ship something credible.

But notice the shape of even the strong dimension. Every one of these controls is exercised through the vendor's own API against the vendor's own store. Consent is honored only as long as you trust the operator to honor it. There is no user-held, cryptographically enforced control anywhere in the set. The best the market has built is a deletion button you have to trust someone else to press.

Why no incumbent has shipped the fix

The capability that is missing is not exotic. A portable, signed, consent-aware memory record needs three things, and every field has a precedent in an existing spec. A self-describing, vendor-neutral format that carries the whole memory, not the everything-but-the-archive and not a plaintext dump, so import is lossless. Cryptographic provenance bound to the record itself, signed so the attribution survives export and can be checked offline. And verifiable integrity, a signature or hash chain a third party can validate without trusting the originating store. Turn "trust my database" into "check the math."

So why has no incumbent shipped it? The business model points the other way. Each of these six is either a managed store monetizing retention or a framework whose value is ecosystem gravity. Portability and third-party verifiability both reduce lock-in and remove the vendor as the necessary trust anchor, which is precisely the moat. Signing also imposes real costs no one has had a commercial reason to pay: key management, a stable canonical serialization, and a governance body for the format. Even Letta's "open standard" Agent File has no neutral governance, no formal versioned spec, and no third-party implementation as of June 2026.

The market has mature consent controls, sophisticated storage models, and zero ability to prove a memory once it leaves the store.

What this means for agent commerce

Memory is moving from a feature that makes a chatbot feel attentive to a substrate that agents transact on. An agent that pays on your behalf is acting on what it remembers: the budget you set, the categories you allowed, the merchant you approved. The other side of that transaction, the merchant or the processor, has no contract with the memory store and no way to check what the agent claims to remember. They are being asked to rely on an assertion they cannot verify.

This is the same gap we keep hitting one layer up. Identity asks who the agent is. Commerce asks what it may spend. Observability asks what it did. Memory sits underneath all three, because every one of those answers is something the agent has to remember and, at some point, prove. An unsigned memory undermines a signed mandate, because the mandate was issued against facts the agent holds in a store no one can check. The credential at the top is only as trustworthy as the record at the bottom.

Which is why the fix is not a better store. It is a record format that travels: signed at the point of authorship, portable across vendors without losing its provenance, and bound to a consent scope the holder controls rather than the operator. RememberKit is our first pass at that record, signed, scoped, and content-addressed so a memory verifies on its own. The report is the measurement of the gap. The primitive is the response to it.

The market spent its effort on storage and consent and skipped the one property that lets memory cross a trust boundary. As agents start to transact, that is the property that matters most, and it is the one that, right now, no one ships.