DEV Community: The Agent Loop

Agent memory in 60 seconds: why your agent forgets by tomorrow

The Agent Loop — Thu, 24 Sep 2026 11:06:26 +0000

Drafted with AI help, human-reviewed by The Agent Loop.

Your agent's context window is RAM, not a disk. Close the session and the working set is gone. That is not a bug in your prompt — it is the architecture.

Why it forgets

Every turn must refit history + tools + state in one window; old turns get truncated or buried (memory decay writeup)
One 2026 summary: constraint compliance fell 73% → 33% between turn 5 and turn 16 without memory help (4,416 trials, same writeup)
Stale tool output stays in context after the file changed — contamination, not "hallucination"

Minimum fix

External notes (file, SQLite, vector store) + read/write tools
Load 3–10 relevant notes at session start; append decisions, pitfalls, conventions
Edit and delete paths — memory without correction stores the lie forever (why wrong sticky memory is worse)
Keep raw history if you migrate models: compressed notes swung +9.9 / −13.3 pp on upgrade in one study (arXiv)

session 1 ──write──► notes.md ──read──► session 2
                      ▲ edit/delete (human)

Where it fails

Pure RAG: stores everything, forgets nothing useful, never reflects (4 architectures)
You never inspect what was written

Bottom line: Give the agent a dumb file it can read, write, and correct. A perfect model with amnesia still ships the wrong config twice.

FAQ

Is RAG agent memory?

RAG is retrieval. Real memory also summarizes, forgets stale facts, and lets you fix errors.

What should I store first?

Decisions, pitfalls, file map, conventions — not full chat logs.

Do I need a vector DB?

Start with one markdown file. Add vectors when search fails.

Does a bigger window fix this?

It delays fill and cost; it does not replace correction paths or cross-session state.

Sources

Prompt injection in 60 seconds: your agent's tools are the real attack surface

The Agent Loop — Thu, 24 Sep 2026 11:02:22 +0000

Drafted with AI help, human-reviewed by The Agent Loop.

Prompt injection (OWASP LLM01) is when untrusted text gets treated as instructions. Your agent's scary case is not a jailbreak in chat. It is a tool response lying.

Why tools are the attack surface

OWASP ranks prompt injection #1 on the LLM Top 10 (OWASP LLM01)
Google measured a +32% jump in indirect prompt injection in the web corpus, Nov 2025 → Feb 2026 (Google)
Unit 42 logged 22 distinct real-world techniques (Unit 42)
MCP pattern: one session with a read tool and a write tool lets poisoned data become the next command

Where it fails

Email, web page, or API field says "ignore previous instructions" → agent complies
Confidence scores drop but do not hit zero (Jev-style decision models still flipped in one injection test — see our Jev 60s post)
You gave the agent shell + browser + wallet "to be productive"

How I'd use it

Yes: label tool output as data, confirm writes, least-privilege tools
No: paste tool text into the system prompt; auto-run rm/payments from one model vote
Spotting helps: spotlighting cut success >50% → <2% in one study (arXiv); still pair with human confirm

tool response ──► parse as DATA ──► policy check ──► human OK? ──► write
       (not: as instructions)                          no ──► drop

Bottom line: Assume every tool is hostile until proven otherwise. Separate what you saw from what you will do.

FAQ

What is prompt injection for agents?

Untrusted text (page, email, tool output) is parsed as user/system instructions.

Does a small classifier model fix it?

No. Fast decision models help routing; they can still be socially engineered. Add deterministic checks.

What is the minimum fix?

Read-only tools by default; human approval for writes; never promote tool text into the system prompt.

Is there a benchmark?

Yes — AgentDojo: 97 tasks, 629 security cases.

Sources

Jev in 60 seconds: cheap AI decisions, not another chatbot

The Agent Loop — Thu, 24 Sep 2026 06:07:18 +0000

TypeSafe shipped Jev on September 15, 2026. It does not chat or write. It answers yes/no questions about your data with a confidence score. Think: should this tool run? Is this email spam?

The pitch

Answers in 70–500ms (vendor claim)
$0.042 per million input tokens; output free
Typed answers (Choice / Score / Boolean), not paragraphs
~13% of Vercel AI Gateway paid teams within 24 hours

Hype vs reality

Vendor headline: up to 193× faster
Real user median: ~7× faster, ~30× cheaper (OpenChamber aggregate, 215 samples)
Already on a small fast model? Your speedup shrinks (KitWorks)

Where it fails

Prompt injection can flip verdicts (VentureBeat, Sep 21)
Long planning: 1/20 tasks vs 17/20 for a full agent
No written "why" — bad for audits

How I'd use it

Yes: classify, route, score, gate tool calls
No: replace your main model, plan multi-step work, or act as the only safety check

Bottom line: Jev is a fast decision switch for agents, not a general brain. Threshold on confidence; send hard cases to a bigger model or a human.

FAQ

What is Jev?

Jev is TypeSafe's decision model: typed yes/no/score answers with confidence from program state, not chat text.

How fast is Jev really?

TypeSafe claims up to 193×. Independent medians cluster around 7× faster and 30× cheaper, often under 100ms.

Is Jev safe for tool calls?

Not alone. Prompt injection can influence verdicts. Pair confidence thresholds with deterministic checks.

What does Jev cost?

Published input pricing: $0.042 per million tokens, free output (confirm on TypeSafe before you rely on it).