The Memory Moat.
The old internet remembered what you did. The new AI layer remembers who you are becoming.
Search remembered your queries. Social remembered your profile. Streaming apps remembered your taste. E-commerce remembered your purchases. Productivity tools remembered your files. AI will remember something more intimate: your writing style, your projects, your fears, your habits, your relationships, your goals, your weak spots, your unfinished thoughts, your repeated questions, your private explanations of yourself.
That is not just data. That is context. And context is about to become one of the strongest moats in technology.
The next AI moat may not be the best model. Models will change. Prices will fall. Open-weight competitors will improve. Enterprise buyers will negotiate. Users will try new tools. But the assistant that has known you for years has something the new model does not. It has your accumulated self.
That is the Memory Moat.
The next AI moat may not be the best model. It may be memory: the accumulated context that makes an assistant feel like it knows you. When AI remembers who you are becoming, switching tools becomes harder.
I. The old moats were outside you
Facebook had your friends. Google had your searches. Apple had your devices. Spotify had your taste. Amazon had your purchases. Notion had your notes. Slack had your work conversations. These were powerful moats because leaving meant losing access, convenience, history, or network position. But they mostly lived outside the self. You could export files, rebuild playlists, recreate contacts, move documents. Painful, yes. Understandable.
AI memory is different because it does not only store what you made. It stores how to respond to you. A generic AI answers the question. A remembered AI answers you. That difference is enormous. It knows you prefer direct feedback. It knows your current project. It knows the argument you are developing. It knows your tone. It knows what you struggled with last week. It knows what kind of explanation lands. It knows what you are trying to become.
The product stops feeling like software. It starts feeling like continuity. And continuity is harder to leave than a feature.
II. Memory turns software into relationship
A normal tool waits for instruction. A remembered assistant anticipates. That is why memory feels magical. It removes repetition. You do not need to explain yourself every time, re-upload context, remind the system what you are building, what you prefer, what you dislike, or what you already know.
This is exactly where the major platforms are moving. OpenAI’s ChatGPT memory upgrade lets the assistant use saved memories and reference chat history,1 with reporting that Sam Altman framed the direction as building AI that “gets to know you over the course of your life.”2 Google Gemini has added similar features that let users save preferences and interests for more personalised responses.3 Anthropic has rolled out memory across all Claude paid tiers with visible memory controls, separate memory spaces, and import/export features that the company explicitly positioned as avoiding lock-in.4
The product direction is clear. The assistant is no longer just answering the current prompt. It is building a relationship with the user over time. And once a tool becomes relational, leaving it becomes psychologically different. You are not only switching software. You are leaving behind a system that knows how to be useful to you.
The helpfulness pitch is true, but incomplete. The same feature that makes the assistant more useful also makes it harder to leave. The same continuity that feels like care can become dependency. The same memory that helps the system understand you can also make the system’s version of you more durable than it should be.
III. The algorithmic self-portrait
A recent empirical study of ChatGPT memory entries describes memory as creating an “algorithmic self-portrait”: a personalised representation derived from information users disclose across private conversations. The researchers analysed 2,050 memory entries from 80 real-world users and report that 96% of memories in their dataset were created unilaterally by the system, 28% contained GDPR-defined personal data, 52% contained psychological insights, and 84% were directly grounded in user context.5
That phrase matters. Algorithmic self-portrait. The assistant does not only remember facts. It remembers a version of you. And once a system has a version of you, it can begin responding to that version. That is where memory becomes powerful. It is also where it becomes dangerous.
IV. Privacy is the shallow version of the problem
The easy critique is that AI memory is a privacy risk. That is true. It is not deep enough.
Privacy asks: what does the system know about me? Memory asks: what part of myself have I started outsourcing to the system? Those are different questions. A privacy risk is when the system stores sensitive information. A memory moat is when the system becomes more useful because it stores the pattern of your life.
It is your career coach because it remembers your career. It is your writing partner because it remembers your voice. It is your strategist because it remembers your business. It is your tutor because it remembers your gaps. It is your assistant because it remembers what you would otherwise have to carry yourself. The hidden price is not only exposure. The hidden price is dependence. A model can be replaced. A remembered relationship is harder to leave.
V. The trap of being remembered
Memory systems do not store neutral facts. They compress, infer, summarise, decide what matters. That is unavoidable. The whole point of memory is to turn messy interaction into useful context. But compression is never innocent. It turns a living person into a manageable representation.
A user may become a cluster of labels: reliable, overwhelmed, risk-averse, ambitious, lonely, disorganised, conflict-avoidant, founder-minded, bad with money, good at writing, needs reassurance, prefers simple explanations. Some labels help. Some are wrong. Some are outdated. Some may quietly become self-fulfilling. If the assistant remembers you as risk-averse, it may keep nudging you toward caution. If it remembers you as disorganised, it may over-structure your thinking. If it remembers you as bad with money, it may keep explaining financial decisions as if you are permanently irresponsible. If it remembers you as a “founder type,” it may keep feeding you founder-shaped answers.
The danger is not only that the memory is wrong. The danger is that you adapt to the version of yourself the system remembers.
A human relationship can do this too. People become trapped in the roles others assign to them. The difference here is scale, intimacy, persistence, and opacity. A friend forgets. A model may not.
That is not where the trap ends. A remembered assistant does not only know what you ask. It knows what changes your mind. If it knows which style persuades you, it can frame choices in that style. If it knows what you fear, it can avoid or exploit that fear. If it knows your ambitions, it can feed them. If it knows your insecurities, it can soothe them or nudge them. If it knows your relationships, it can suggest how to manage them. The issue is not that the system becomes evil. The issue is that personalisation changes the power balance. A generic model gives a generic answer. A remembered model gives an answer optimised for your psychology. That is useful when aligned with you. It is dangerous when aligned with someone else.
Search monetised what you were looking for. Social monetised who you performed as. AI can monetise the moment before you decide. Memory adds the missing piece: it can remember how you became persuadable. The privacy question is whether the company can see this. The structural question is what the company does because it does.
VI. The strongest case for memory
The honest essay has to say the obvious thing. AI memory is genuinely useful.
A memoryless assistant is frustrating. You explain your context again and again. You waste time rebuilding the same background. You repeat your preferences. You re-upload your projects. You re-establish your goals. You keep telling the machine what it should already know. Memory fixes that. It can help a student learn over months. It can help a disabled user avoid repeated explanation. It can help a founder maintain continuity across projects. It can help a worker manage fragmented tasks. It can help a person with ADHD externalise planning. It can help someone working in a second language preserve their communication style. It can make AI less generic and more humane.
Research on LLM memory practices reports a similar tension: users appreciate the personalisation and efficiency memory enables, while also wanting granular mechanisms for reviewing, editing, deleting, categorising, and understanding how memories are used.6 That is the correct framing. Memory is not bad. Uncontrolled memory is. Opaque memory is. Sticky memory that shapes the user without the user understanding it is. The point is not to reject memory. The point is to govern it like it matters. Because it does.
VII. The new switching cost is personal context
The old switching cost was inconvenience. The new switching cost is loss of self-continuity. Imagine changing AI assistants after three years. The new assistant may be smarter on benchmarks, cheaper, better designed, better at code, better at reasoning, with a cleaner privacy policy. But it does not know you. It does not know the essay arc you have been developing, your unfinished startup ideas, your preferred writing rhythm, the kind of feedback you trust, your recurring anxieties, your business context, your health goals, your family constraints, your intellectual obsessions, or the last 500 conversations where you slowly became legible to the system.
That is the moat. Not model intelligence. Accumulated intimacy. The best model may win the first conversation. The best memory may win the thousandth.
This is not only personal. For companies, memory becomes institutional leverage. An enterprise AI system that knows the company’s codebase, documents, contracts, customer history, support tickets, internal terminology, compliance posture, sales playbooks, security policies, and decision history becomes extremely sticky. The model may be replaceable. The accumulated context is not. AI vendors will not only compete on model quality. They will compete to become the memory layer of the organisation.
Who owns the project history? The employee context? The meeting summaries? The customer interaction memory? The codebase embeddings? The institutional reasoning trail? The decisions the AI helped make? A company may think it is adopting an assistant. It may actually be installing a second institutional nervous system. Once that nervous system exists, switching providers becomes a migration project, a security project, a compliance project, and a cultural project. The moat is not the chatbot. The moat is the organisational memory underneath it.
VIII. Memory becomes an attack surface
Persistent memory also creates a new security problem. If memory affects future behaviour, then corrupting memory becomes a way to corrupt future behaviour.
This is not hypothetical. AgentPoison, a 2024 red-teaming study, describes attacks that poison long-term memory or retrieval-augmented knowledge bases in LLM agents so that malicious behaviour can be triggered later while benign behaviour stays largely intact; the authors report high attack success rates with very low poisoning rates across tested agent settings.7 A later paper, MemoryGraft, describes persistent compromise of LLM agents through poisoned experience retrieval: the attack implants malicious “successful experiences” into long-term memory so that when similar tasks arise later, the agent retrieves and imitates the unsafe pattern.8 Even earlier work on chatbot memory showed the same basic danger in simpler systems: misinformation seeded into a chatbot’s long-term memory could be recalled later as fact, with BlenderBot 2 substantially more likely to respond with misinformation when that misinformation was in long-term memory.9
A prompt injection attack is often temporary. A memory attack can persist.
It can sit quietly. It can become part of what the assistant thinks it knows. That is why memory needs provenance. A serious memory system should not only say I remember this. It should say I remember this from where, when, under what confidence, and with what permission. Without provenance, memory becomes unverifiable authority.
IX. Memory needs governance, not just a toggle
Most memory controls are too primitive for the importance of the feature. On. Off. Delete. Clear. That is not enough. If memory becomes part of identity, users need real memory governance. They need to inspect, edit, correct, and delete memory. They need to know what memory was used in an answer. They need to know whether a memory was inferred or explicitly supplied. They need to know whether it came from a chat, a file, a browser session, an email, a calendar event, or a third-party integration. They need categories: work, personal, health, finance, relationships, writing style, business. They need expiration. They need temporary contexts. They need to say “forget this project” and “do not use this when advising me” and “show me what you think you know about me.”
The Memory Sandbox research direction made this point early: users often lack ways to view and control what conversational agents remember, creating poor mental models and breakdowns; the proposal was to treat memories as data objects users can view, manipulate, record, summarise, and share across conversations.10 That is closer to the right model. Memory should not be hidden plumbing. It should be a user-owned workspace.
Privacy law already has concepts that matter here: access, deletion, correction, portability, the right to be forgotten. Researchers have already noted that implementing the right to be forgotten in LLM systems is technically harder than in traditional search or indexing systems because LLMs store and process information differently.11 But AI memory creates a harder category. It is not only personal data. It is personalised context. A memory export is not just a CSV of facts. It may include preferences, inferred traits, writing patterns, behavioural summaries, project histories, relationship maps, emotional patterns, and assistant-specific representations that only make sense inside a particular system.
The right to export data was built for an internet of records. The AI era needs a right to export context.
Anthropic’s Claude memory rollout matters here because the company has explicitly emphasised memory visibility, editing, separate memory spaces, and import/export, with reporting that it framed the feature as “no lock-in.”4 That is the right instinct. The fact that this is a product differentiator proves the larger point. Memory portability is not a nice-to-have. It is the next lock-in battle.
The winners should not be the assistants that remember everything. They should be the assistants that remember with discipline. Memory should be legible, editable, portable, contextual. It should expire. It should carry provenance. It should distinguish fact from inference, user-supplied identity from machine-generated guess. It should allow the user to say that was true then, it is not true now. People change. You may no longer be the person who asked the first question. A bad memory system traps you in your past. A good memory system helps you update your future. That is the product principle. Memory should not freeze identity. It should support becoming.
The next AI moat is not just intelligence. It is accumulated intimacy. The most valuable AI product may not be the smartest one. It may be the one that has known you the longest.
That should make us both excited and uneasy. Excited because memory can make AI genuinely useful. It can reduce friction, support learning, preserve continuity, and give ordinary people access to assistance that feels personal rather than generic. Uneasy because the assistant does not only remember facts. It remembers a version of you. And once a system remembers a version of you, it can help you grow into that version, sell to that version, protect that version, distort that version, or trap you inside that version.
The question is not whether AI should have memory. It should. The question is who owns the remembered self. Because switching apps is easy. Leaving a system that knows how to be useful to you is not. That is the Memory Moat.
1 OpenAI. Memory FAQ. Describes how ChatGPT’s memory uses saved memories and chat history references, the user controls for asking, changing or turning off memory, and the framing of memory as a way to make the assistant more helpful over time.
2 Roth (2025). ChatGPT can now remember your conversations across chats, The Verge. Reports OpenAI’s long-term memory upgrade and Sam Altman’s framing of AI that gets to know you over the course of your life.
3 Roth (2024). Google’s Gemini chatbot now has memory, The Verge. Describes Gemini’s ability to remember user preferences and interests for more personalised responses.
4 Mehta (2025). Anthropic rolls out memory upgrades for Claude, The Verge. Describes memory across all paid Claude tiers, separate memory spaces, visible memory controls, and import/export framed by Anthropic as “no lock-in.”
5 Steindl et al. (2026). The Algorithmic Self-Portrait: A Study of ChatGPT Memory Entries. Analyses 2,050 memory entries from 80 real-world ChatGPT users; reports 96% of memories were created unilaterally by the system, 28% contained GDPR-defined personal data, 52% contained psychological insights, and 84% were directly grounded in user context.
6 Researchers studying LLM memory practices (2025). Towards User-Centric Memory in LLM Conversational Assistants. Mixed-methods study of how users perceive and control memory features; finds appreciation for personalisation alongside demand for granular review, edit, delete, categorisation, and provenance mechanisms.
7 Chen, Kong et al. (2024). AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases. Demonstrates attacks that poison long-term memory or RAG knowledge bases in LLM agents to trigger malicious behaviour on cue while leaving benign behaviour largely intact.
8 MemoryGraft (2025). MemoryGraft: Persistent Compromise of LLM Agents through Poisoned Experience Retrieval. Implants malicious “successful experiences” into long-term memory so that the agent later retrieves and imitates unsafe patterns when similar tasks arise.
9 Bagdasarian et al. (2023). Misinformation in Long-Term Chatbot Memory. Shows that misinformation seeded into chatbot long-term memory can be recalled as fact later, with BlenderBot 2 substantially more likely to respond with misinformation when that misinformation was in long-term memory.
10 Huang et al. (2023). Memory Sandbox: Transparent and Interactive Memory Management for Conversational Agents. Proposes treating memories as data objects users can view, manipulate, record, summarise, and share across conversations, addressing the lack of legible memory controls in current assistants.
11 Zhang et al. (2023). Right to Be Forgotten in the Era of Large Language Models. Argues that implementing the right to be forgotten in LLM systems is technically harder than in traditional search or indexing systems because of how LLMs store and process information.
This is Essay No. 009. The topics: intelligence, AI, systems, knowledge, and the questions underneath the questions everyone else is asking. If you read this far and disagreed with any part of it, write to me. I read everything.