You Cannot Detect a Poisoned Memory. You Can Hash the File It Came In.

“There remains no way to have an agent distinguish ‘good prompt’ from ‘evil prompt’.” That sentence, from Cal Paterson’s August 2026 write-up of a memory file format he calls Memoryfields, is the most useful sentence I have read about agent memory security this year, and it is a concession.

Every runtime defense for agent memory assumes a classifier that does not exist. Once a stored note is in the context window, it has the same standing as the instruction the user typed. Paterson’s conclusion follows: “You must not share your context window, including via memories, with parties you don’t trust.” His answer is a file format.

What The Format Actually Is

A .memoryfield.zip holds Markdown pages, each with optional YAML frontmatter, plus an optional SQLite vector index. That is the whole artifact. The spec lives at github.com/calpaterson/memoryfield-spec, alongside a CLI (memoryfield-tool) and an agent skill (memoryfield-skill).

Pages carry a soft size limit of roughly 8kb, about 2000 tokens. Paterson translates it for anyone who has not thought in tokens lately: “8,000 characters is about 1,300 words, or the length of a medium-length magazine article.” The unit of memory is a magazine-article-length page, which means it is also a page a reviewer can read inside a diff.

The retrieval side is deliberately unimpressive. The embedding model is nomic-embed-text-v1.5, which Paterson describes as “small enough (270MB)” and “over 2 years old.” The claim embedded in that choice is that memory retrieval was never bottlenecked on embedding quality. A two-year-old 270MB model finds the right page.

One caveat before going further. This is one developer’s proposal published on his own site. There is no standards body behind it, no adoption to point at, and nothing here should be read as an emerging industry format. What makes it worth an essay is that it is a concrete artifact rather than another principle.

The Performance Argument, And Its Limits

Paterson’s case against graph-shaped memory is about round trips. Knowledge graphs make an agent walk edges, and each hop is a tool call, “each of which takes maybe 2-3 seconds.” His formulation: “If the relevant information is N steps deep in the knowledge graph, N+1 tool calls are required.” Against a flat searchable corpus, “at most 2 tool calls are required (#1 to search, #2 to read in parallel).”

Treat those numbers as an argument, not a measurement. Paterson publishes no benchmark methodology, no comparison system, and no dataset. The 2-3 seconds is his characterization of tool-call latency in graph traversal, and the N+1 figure is a structural claim about how graph walking works rather than a timing anybody reproduced. Until then this is a well-reasoned position from one engineer.

The structural claim is the durable half anyway. Sequential dependency between retrieval steps is a real property of graph traversal. You cannot parallelize hop three before hop two returns. Whether that costs 2 seconds or 200 milliseconds per hop, the shape of the cost curve does not change.

Why The Governance Case Is Stronger Than The Performance One

Paterson quotes Fred Brooks: “Show me your flowcharts and conceal your tables, and I shall continue to be mystified. Show me your tables, and I won’t usually need your flowcharts; they’ll be obvious.” He uses it to argue for data over structure. It applies just as well to auditability.

A memory system whose state lives inside a managed vector store answers almost no governance question directly. What did the agent know last Tuesday? What changed between the run that behaved and the run that did not? Which page carried the instruction that caused the incident? In practice each of those tends to become a support ticket to a vendor, or a query against a store that was never designed to answer historical questions.

A static zipfile answers them with tools every engineering organization already runs. You can diff two versions. You can check a page into version control. You can compute a sha256 of the archive an agent was given, record it beside the run, and later prove which bytes were in the context window. Nothing in the format mandates that pin, and the spec does not describe tooling that ships it. It is a control the shape of the artifact makes available to whoever wants to build it, which is exactly what a file format should do and no more.

That distinction matters for how you evaluate the idea. Memoryfields does not defend you against memory poisoning. Paterson says so himself. What a static, hashable file gives you is the ability to answer, after an incident, what the agent was actually carrying. Detection stays impossible. Attribution becomes cheap.

Where This Lands Against What We Have Argued Before

We surveyed the three patterns agent memory keeps collapsing into and which of them survive contact with production. We argued that knowledge wins agent-readiness by becoming a format rather than a platform. We argued that memory is the moat you cannot carry between harnesses.

All three of those were arguments about principle, made without a published spec to point at. Memoryfields is the first artifact we have seen that encodes the principle in a file layout: a zipfile, Markdown pages, an optional index, and a spec repository anyone can read in an afternoon. It may go nowhere. The design still shows what the portable version of this looks like when someone stops arguing and writes the schema.

Do This Now

Take one agent you run in production and answer a single question: if that agent acted on a memory it should never have had, could you prove which memory it was?

Concretely, three checks. Can you export the agent’s full memory state to a file right now, without a vendor ticket? Can you compute a hash of that state and store it beside a run record? If two runs on the same prompt diverge, can you diff the memory between them?

If any answer is no, you are running agents whose knowledge is unattributable after the fact. That is a worse position than most teams believe they are in, because the failure is silent until an incident forces the question. The fix is cheap: insist that whatever memory system you adopt can hand you a file.

---

This analysis synthesizes Agent memory as a file format (Memoryfields) (Cal Paterson, August 2026).

Victorino Group helps engineering organizations make agent memory exportable, hashable and auditable before an incident forces the question. Let’s talk.