Claude lets you move AI memories. Keeping them trustworthy is harder

What changed

On November 2, Anthropic introduced a built-in way to import memories from other AI providers into Claude and export Claude memory. The feature is available on the web and in Claude Desktop across Free, Pro, Max, Ultra, Team and Enterprise plans, according to Anthropic’s help article, updated November 3.

That is a useful step beyond moving a conversation transcript. A transcript records what was said; a memory profile is intended to carry forward information an assistant can use later. If people can take that profile with them, changing assistants need not mean rebuilding every preference and piece of context from scratch.

But this is not seamless portability. Anthropic describes imports as experimental and says imported memories may not always be incorporated successfully. The transfer is text-based, not a guaranteed or standardized way to preserve what one assistant knows when moving to another. For someone considering a switch, the practical distinction matters: being able to bring information over is not the same as knowing the new assistant will remember, interpret and use it as expected.

The launch also puts a harder question in view. Once a memory can travel between services, what should happen if it contains an unwanted detail, a misleading conclusion or an instruction planted by someone else? Two papers submitted in the same short window examine different ways persistent memory can go wrong. Neither is a verdict on Claude’s new feature. Together, they offer a useful checklist for evaluating any assistant that keeps context over time.

Portability is a beginning, not a promise of equivalence

Anthropic deserves credit for making memory movement an explicit product feature and for stating its limitation. People should have a way to leave an assistant without treating accumulated context as something they must abandon. Making export available also gives users a means to keep a copy of their Claude memory.

Still, a transferable text profile is only one layer of portability. A receiving assistant has to incorporate that information, and a person has to be able to tell whether the result is faithful enough for their purposes. Anthropic’s warning about unsuccessful imports is a reason to verify the outcome rather than assume that completing the transfer completes the move.

Think of a remembered preference that was useful in one setting but too broad in another. Or a note that was accurate months ago and is no longer true. Those examples are possibilities, not reported failures of Claude’s import flow. They illustrate why a portable profile should be treated as information to review, not as an unquestionable record of who someone is or what they want.

The instruction that survives the conversation

A November 1 paper introducing MemHarmBench examines a different problem: malicious instructions that get into an AI agent’s persistent memory and influence later tasks, after the original content is no longer present. The researchers report that the influence can be difficult to notice. An agent may appear to handle a legitimate request normally while making a decision that follows the planted instruction.

This matters because the familiar picture of a prompt injection—a hostile instruction encountered during one task—does not capture the full risk when an agent remembers. Persistence gives the instruction another chance to affect a future decision, potentially in a context where the user cannot see where it came from. A test that asks only whether the agent visibly failed the immediate task could miss that kind of influence.

MemHarmBench is a research benchmark, not evidence that a particular consumer assistant has suffered such an attack. Its value is in sharpening the question designers and evaluators ask: Did the agent merely finish the task, or did remembered material quietly change whose interests its decision served? That distinction becomes more important as memory is used to support work across sessions.

Claude’s import flow and this research are separate developments. The paper does not test Anthropic’s feature. But moving remembered text between systems makes the provenance of that text worth considering. A receiving assistant should not treat a transferred profile as an instruction source with unlimited authority simply because it arrives through a memory feature.

When a remembered fact stops being true

Another paper, A State Change Is Local, Its Consequences Are Not, submitted November 2, looks at the problem of updating long-term agent memory. Its proposed method, StateGraph, tracks dependencies between remembered facts and the beliefs, plans or actions built on them. The aim is to revise a downstream conclusion when a fact it relies on changes, while keeping that conclusion if it also has independent support. The authors introduced a 50-case benchmark, StateChangeBench, alongside the method.

The everyday version is straightforward. If an assistant has made plans using an old fact, correcting that fact should prompt it to reconsider the affected plans. Yet deleting everything connected to the old fact would be blunt: some conclusions may still be sound for other reasons. Good memory maintenance requires knowing both what changed and what depends on it.

StateGraph is a research proposal, not a demonstrated capability of Claude’s new transfer flow or a deployed guarantee for other assistants. It does, however, identify a gap in the idea of portability as simple copying. Carrying a memory forward is useful only if the system can also handle corrections without continuing to rely on outdated premises.

What should never become memory?

The question starts even earlier: should a piece of information be retained at all? In an October 20 study on what AI should forget, researchers drew on 179 incidents reported by 146 users, identified 15 categories of information people wanted excluded from AI memory, and presented FENCE, a system designed to apply user-defined protections as memories are formed.

That work focuses on a distinction easy to miss in a helpful conversation. A person may tell an assistant something because it is relevant right now, without consenting to that detail becoming part of a persistent profile. An erase button is important, but preventing unwanted retention in the first place addresses a different moment in the process.

Taken together, the product change and the papers suggest three separate tests for lasting AI memory. Can I move it? Anthropic has made a concrete, if experimental, move on that question. Can I limit what enters it and what it is allowed to do? The privacy and injection research shows why that matters. Can it change its mind when the underlying facts change? The state-revision paper makes that problem explicit.

For now, users should treat a memory transfer as a starting point, not proof of a faithful migration. Review what is being carried over, check whether the receiving assistant actually uses it as intended, and correct information that should no longer guide future responses. Portability is valuable. The harder standard is a memory people can carry, inspect and safely revise.