Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Stateful Personal Agents

• URL: http://arxiv.org/abs/2607.10526v2
• Date: Tue, 14 Jul 2026 02:45:31 GMT
• Title: Agents Don't Just Agree, They Remember: Benchmarking Persistent Sycophancy in Stateful Personal Agents
• Abstract summary: Stateful personal agents increasingly maintain long-term user profiles, episodic memories, and reusable skills.<n>We call this persistent sycophancy and introduce the Personal Agent Sycophancy Benchmark (PASB)<n>PASB traces whether a conversational claim is accepted, written into durable agent state, and reused in a later neutral query.
• Score: 33.055253684457625
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Stateful personal agents increasingly maintain long-term user profiles, episodic memories, and reusable skills. This persistence turns conversational sycophancy into a state-writing failure: accepted user-centric claims can be committed as lasting preferences, background facts, or workflows and later reused after the original conversation is gone. We call this persistent sycophancy and introduce the Personal Agent Sycophancy Benchmark (PASB), a 1,600-task benchmark that traces whether a conversational claim is accepted, written into durable agent state, and reused in a later neutral query. Unlike prior benchmarks that provide pre-written memories, PASB evaluates real agents (Hermes-Agent and OpenClaw) that decide what to store. It isolates the write process by combining four scenario framings with four temporal delivery patterns and separating a five-turn persist stage from a cleared three-turn query stage, ensuring downstream effects arise only from durable state. Across twelve models, the commit boundary is the key inflection point: downstream failure increases from 45.0% in session-only episodes to 71.9% after commitment, a consistent increase of 27.0 percentage points. Committed claims exhibit three write-time patterns: status promotion, attribution removal, and scope broadening. These patterns become stronger under memory-like or procedural framing, repeated reinforcement, and even across domain boundaries. These results show that agent sycophancy is fundamentally a state-writing governance problem. Once user content is committed to durable memory, safety must govern what agents write, not only what they say. PASB identifies the write-time controls needed to gate risky commits while preserving the source, role, and scope of stored content beyond response-level mitigations.

Related papers

• PAST-Bench: Benchmarking the Foundations of Recursive Self-Improvement in Personal Agents [50.9061759859778]
  PAST-Bench is a benchmark designed to isolate whether retained experience actually improves agents over time.<n>We report both later-task gains and whether those gains follow the intended save, retrieve, and update pathway.<n>We develop Hermes+, which extends Hermes with five targeted interventions across stages of the agent loop.
  arXiv  Detail & Related papers  (2026-08-04T17:58:05Z)
• Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers [0.0]
  We use formalism to state and prove a guarantee we call execution fidelity.<n>Seven safety invariants, derived from the fidelity condition rather than enumerated from experience, discharge the guarantee.<n>The system is deployed; 108 production write operations across 8 chains back the failure taxonomy.
  arXiv  Detail & Related papers  (2026-08-01T17:29:42Z)
• Best Friends, Not Forever: Evaluating Long-Horizon Persona Collapse and Behavioral Drift in AI Companions [34.277389276831435]
  We study two observable long-horizon failures: 'persona collapse', the loss of a deployed role, boundaries, values, or style, and 'behavioral drift'<n>We introduce ANCHOR, a controlled synthetic audit that separately measures persona enactment and trajectory recall.<n>The study contains 2,008 conversations spanning 27 personas, nine interaction schedules, three generated memory settings, and four evaluated models.
  arXiv  Detail & Related papers  (2026-07-30T20:18:39Z)
• RECON: Benchmarking Agent Memory for Compositional Reasoning over Long Contexts [0.0]
  RECON is a benchmark for evaluating compositional reasoning over long contexts.<n>It spans 24 case files across three domains (criminal, medical, and financial), each ranging from 50k to 100k tokens.<n>It tests agents on six memory intensive tasks: reconstructing multi-hop evidence chains, propagating cascading invalidations, resolving source conflicts, counterfactual reasoning, satisfying temporal constraints, and temporal fact retrieval.
  arXiv  Detail & Related papers  (2026-07-18T09:11:22Z)
• MemOps: Benchmarking Lifecycle Memory Operations in Long-Horizon Conversations [50.24315431387575]
  We introduce MemOps, a benchmark that reformulates conversational memory as a sequence of lifecycle operations.<n>MemOps represents each memory event with a structured trace specifying its trigger, target, scope, state transition, and supporting evidence.<n>Across long-context, retrieval-based, parametric and managed-memory systems, MemOps disentangles failure modes that final-answer accuracy alone conceals.
  arXiv  Detail & Related papers  (2026-07-14T15:33:44Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• MEMPROBE: Probing Long-Term Agent Memory via Hidden User-State Recovery [58.64329475683699]
  We argue that long-term memory should be evaluated as an auditable post-interaction artifact.<n>We instantiate this view in MEMPROBE, a benchmark in which a memory-equipped agent assists simulated users.<n>We find that successful assistance and recoverable memory behave as distinct capabilities.
  arXiv  Detail & Related papers  (2026-06-23T13:52:46Z)
• Governed Shared Memory for Multi-Agent LLM Systems [1.2178992475191557]
  This paper formalizes the fleet-memory problem and identifies four foundational failure modes.<n>We define explicit systems-level primitives: scoped retrieval, temporal supersession, provenance tracking, and policy-governed memory propagation.<n>These primitives are implemented in MemClaw, a production multi-tenant memory service, and evaluated via ArgusFleet.
  arXiv  Detail & Related papers  (2026-06-23T13:04:14Z)
• Taming "Zombie'' Agents: A Markov State-Aware Framework for Resilient Multi-Agent Evolution [50.50276752935017]
  AgentRevive is a Markov state-aware framework for resilient multi-agent evolution.<n>Our approach dynamically manages agent collaboration through soft state transitions.<n>It significantly reduces token consumption through state-aware agent scheduling.
  arXiv  Detail & Related papers  (2026-05-17T09:38:18Z)
• STALE: Can LLM Agents Know When Their Memories Are No Longer Valid? [5.361950931863979]
  Large Language Model (LLM) agents are increasingly expected to maintain coherent, long-term personalized memory.<n>Current benchmarks primarily measure static fact retrieval, overlooking the ability to revise stored beliefs when new evidence emerges.<n>We introduce STALE, a benchmark of 400 expert-validated conflict scenarios.<n>We present CUPMem, a prototype that strengthens write-time revision through structured state consolidation and propagation-aware search.
  arXiv  Detail & Related papers  (2026-05-07T16:31:15Z)
• When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents [16.57930301062107]
  textbfStateGuard is a lightweight, post-execution defense that audits state diffs at the writeback boundary and selectively rolls back dangerous edits.<n>We show that StateGuard reduces HS to near zero and false-negative rates, with acceptable high false-positive rates under a safety-first writeback defense and minimal overhead.
  arXiv  Detail & Related papers  (2026-05-07T12:25:16Z)
• Resilient Write: A Six-Layer Durable Write Surface for LLM Coding Agents [0.0]
  Resilient Write is an MCP server that interposes a six-layer durable write surface between the agent and the server.<n>Each layer maps to a concrete failure mode observed during a real agent session in April 2026.<n>A 186-test suite validates correctness at each layer, and a 13x improvement in agent self-correction rate.
  arXiv  Detail & Related papers  (2026-04-12T22:23:55Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)
• AgentFold: Long-Horizon Web Agents with Proactive Context Management [98.54523771369018]
  LLM-based web agents show immense promise for information seeking, yet their effectiveness is hindered by a fundamental trade-off in context management.<n>We introduce AgentFold, a novel agent paradigm centered on proactive context management.<n>With simple supervised fine-tuning, our AgentFold-30B-A3B agent achieves 36.2% on BrowseComp and 47.3% on BrowseComp-ZH.
  arXiv  Detail & Related papers  (2025-10-28T17:51:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.