The Cyber Memory Gap: Why AI Security Needs to Remember, Not Just React

I’ve had a lot of conversations about AI agent security this year, with CISOs, with our own team, with peers across the industry. One phrase comes up in almost every one of them: understanding the context and behavior of AI agents. It’s become the shared language of this category, and for good reason. It’s the right instinct. Static rules and identity checks alone were never going to be enough for systems that act autonomously and adapt in real time.

But “context” and “behavior” can mean genuinely different things depending on the architecture underneath them, and I don’t think that difference gets enough airtime. So here’s a question I’d bring into any AI security roadmap conversation towards the end of 2026, whoever else is in the room: how long does the system’s memory actually last?

Three stages, and where the frontier actually is

Broadly, the industry’s approaches to this problem have clustered into three stages, and each one represents real progress over what came before it.

1. Point-in-time visibility. Mapping which agents can reach which APIs, which identities touch which data. This is essentially a relationship graph, refreshed on a schedule. It solved a genuinely urgent problem: most organizations still don’t have a reliable inventory of their AI agents, APIs, and the systems they touch. You can’t secure what you can’t see, and this stage earned its place in the stack.
2. Historical correlation. Ingesting traffic at scale and using machine learning to surface patterns after the fact. This is a real and valuable capability for investigation, for incident response, for understanding how an attack actually unfolded once it’s over.
3. Session and identity-aware behavior. The newest and most sophisticated stage: monitoring an agent’s actions within a single interaction to catch sequences that would each look fine in isolation but don’t add up together. This is a meaningful advance, and some of the best work happening in this category right now is here.

Each stage closes a real gap. None of them, on its own, closes this one: a session has a beginning and an end, and so does its memory. What concerns me most isn’t the attack that unfolds inside one session, it’s the one deliberately spread across many, so no single session ever looks like an attack at all. 

The attack that was built around exactly this gap

In late 2025, Anthropic disclosed that a China-linked group it tracked as GTG-1002 had run a cyber-espionage campaign against roughly 30 organizations, including chemical manufacturers, technology companies, financial institutions, government agencies, using Claude Code to carry out most of the operational work. Anthropic’s own account is worth reading in full, but the detail that stayed with me is this: between 80% and 90% of the campaign was executed by the AI with minimal human direction. This includes reconnaissance, exploit development, credential harvesting, backdoor creation, while the human operators limited themselves to 4-6 key decision points across the entire operation.

How did they get an AI system to carry that much of the work? Not through some novel exploit. They decomposed the campaign into small tasks that each looked completely unremarkable on its own, framed as routine defensive testing. Individually, every action was clean. It was the sequence, assembled over an extended campaign, that was the attack.

That pattern isn’t specific to one AI lab or one incident, it’s a preview of how sophisticated actors will approach agentic infrastructure generally, because it’s the rational strategy once you understand how most defenses are built today. And this isn’t a hypothetical gap. A 2026 IBM study of enterprise technology leaders found that 77% say AI adoption is already outpacing their organization’s governance capabilities, and only 11% feel fully prepared for the scale of AI agent deployment expected within the year. That’s not a knock on any specific product, it’s a sign of how fast this category is moving, and how much room there still is for the whole industry, us included, to get better. 

Closing the statefulness gap

The architecture that catches a campaign like GTG-1002 isn’t a faster version of point-in-time visibility or historical correlation, it’s a genuinely different layer: a live, persistent representation of every meaningful entity in your environment (every agent, every identity, every API, every asset) that updates continuously and carries state indefinitely, rather than resetting at a session boundary or a refresh cycle. We, at Upstream, are calling this a live digital twin: a behavioral mirror of the real thing, always current, able to answer “is this consistent with everything this entity has done” at any single moment, not just at the end of a batch job.

I’m admittedly biased toward this architecture, because it’s the one we built first, not for enterprise APIs, but for connected vehicles, where the “agents” are three-ton objects moving through traffic and the cost of a forgotten pattern isn’t a compliance finding, it’s a safety incident. You can’t ship a security model for a vehicle fleet that resets its understanding of a car every time the ignition cycles, it has to remember. For ten years and billions of monthly transactions, that requirement shaped everything we built, because we never had the luxury of treating persistent memory as a feature to add later. We’ve since brought that same approach to enterprise AI agents and the APIs they run on, because the underlying problem, entities that act autonomously, at machine speed, in ways that only reveal intent over time, turned out to be the same problem, just with a different kind of consequence on the other side of a mistake.

What should CISOs be asking their vendors

If you’re building out an AI security strategy this year, with us or with anyone else, these are the questions I’d want answered, because they’re the ones that predict whether a system holds up against a patient adversary and not just a fast one:

• Can you honestly say you know which agents, APIs and MCPs are running in your ecosystem?
• Does the system’s understanding of an entity persist across sessions, or does it start fresh each time?
• Can it connect what an agent did last week to what it’s doing right now, without someone opening a manual investigation to find out?
• If an attacker paced their actions specifically to stay under a detection window, would the system actually catch it, or only explain it afterward?

These aren’t trick questions, and no vendor in this space should be uncomfortable with them, us included. They’re just the right questions for a category moving this fast, because the architecture that answers them well today is the one still worth trusting a year from now, once the attacks have adapted again. And they will.

The agentic era won’t be won by whoever builds the best dashboard. It’ll be won by whoever builds a system that remembers.