Your AI's Memory Cites Its Sources Now. It Still Isn't Safe.

A citation tells you where a line came from, not whether someone planted it.

Across the last two pieces I argued for memory you keep in a file you own, instead of a setting you can’t see. It’s an idea a lot of people are arriving at independently. One of the most complete versions I’ve found is a memory layer for Claude Code from Aakash Gupta: plain markdown, every claim carrying a source, the whole thing yours to read. I went through it closely, partly because his frameworks are part of how I think about this work. The file-based bones are right. It’s the safety story I want to pick at.

The centerpiece is a check that runs the instant the layer tries to save something. If it goes to record a claim — “users want weekly batch” — without pointing at the call or the note it came from, it stops, and won’t continue until a source is attached. The pitch is that you watch it happen: it refuses to save a claim it can’t back up, so you don’t have to trust the memory is clean. And to his credit, he says plainly where this stops. “Provenance tags prove where a claim came from, not that the claim is true.” That’s exactly right. He just stops one case short of the one that matters.

There are two ways a claim ends up wrong in your memory. The first is an honest mistake — a misheard line in a transcript, a number you fat-fingered. That’s the case the check has in mind, and against it a source helps a little: when the claim looks off later, you can trace it back and see where it went sideways. The second way is the one my last piece was about. Someone put it there on purpose.

Against that, the source requirement does nothing, because the poison never arrives without a source. SpAIware, one of the prompt-injection attacks from the last piece, hid its instructions inside a web page the model was asked to read. ZombieAgent hid them in an email, and the agent obeyed while it worked through the inbox. The planted line doesn’t show up naked, begging to be saved. It shows up wearing the most ordinary citation there is — a real document your assistant really read. A check that demands a source is a door the attacker already walked through to get here.

Then it gets worse, because the check doesn’t just let the poison past. The planted instruction comes out the other side wearing a footnote, filed in your durable memory beside everything legitimate, citation and all. The one mechanism sold to make you trust the memory is the same mechanism that makes the bad line look trustworthy.

Provenance didn’t catch it. It notarized it.

My own setup does this too, so I’m not pointing from a safe distance. My memory lives in plain-text files I keep, and a small script runs every time one of them saves, blocking the write if the note is missing the fields that tie it back to its source. I wrote that script. It’s good hygiene, and it is not a guard. It checks that a source is present, never that the source is clean or that the claim is true. Hand it a sourced lie and it files the lie. By the same logic, mine would wave the same poison through without blinking.

So what actually protects the file? Two things a citation can’t give you. I chose what came in — nothing lands in there that I didn’t paste or point it at. And I can read what’s there, in plain words, with nothing stored where I can’t see it. Provenance is an audit tool. It’s the thing you reach for after, when something’s already wrong and you want to trace it back. The defense is the reading, the part that catches the bad line before it sets. Worth having the trail. A mistake to read the trail as a guard.

Aakash's own pitch puts it plainly. “You don’t have to trust that the memory is clean. You watch it refuse to save a claim it can’t back up.” That does something quiet and wrong. It swaps the audit tool in for the guard. The refusal you watched is real, and it proves the line now has a source. It proves nothing about whether the source was yours.

I’ll end where the last two did. Own your memory so it’s reliable; own it so you can see when someone writes to it; and now that the tools are learning to cite their sources, don’t let the footnotes talk you out of looking. A citation tells you where to look, never that you can stop. Mine isn’t a feature, it’s a file. It isn’t safe because every line wears a source. It’s safe because I’m still the one reading it.