My local AI agent remembered things I never said. A reader's security review found it.

Description and use

CORTEX was unintentionally storing facts from content the user only asked it to process, causing memory errors. After adding filters to accept only user‑self statements and grounding facts, and running strict tests, the issue was fixed and memory now holds only user‑provided facts.

Problem

CORTEX stored user facts from content the user only asked it to process, leading to unintended memory retention.

Outcome

All 13 memory cases passed after the fix; unit tests increased from 264 to 318, and memory now holds only user‑provided facts.

Workflow

• 1. Identify user‑self statements via self_statements() and filter out quoted or fenced text.
• 2. Prevent the model from seeing the filtered material, so it cannot extract facts from unseen JSON.
• 3. Validate each extracted fact with _is_grounded() to ensure it appears in user words.
• 4. Run regression tests marked xfail to confirm the bug is fixed.
• 5. Merge PR and release v1.2.2.
• 6. Provide reset-memory command for users to clear unintended memory.

Evidence

Mustafa showed it was also storing facts from things I only asked it to process.

Source

The last one is the nasty one. Remembered facts go into the system prompt, so a note pasted once would have shaped every later session.

Source

13 memory cases × 3 runs on qwen2.5:7b: 24/39 before, 39/39 after.

Source

The fix proves itself against his cases, not mine.

Source