Memory poisoning
Untrusted or incorrectly attributed material becomes durable context and quietly changes later decisions.
INTEGRITY FAILURE
The security layer for persistent AI
The agent is only as trustworthy as the history it wakes up with.
AI is moving from conversations to persistent agents that use tools, control infrastructure, and act over time. Their continuity is becoming part of the security perimeter. Cadence Continuity is building the control plane that makes that continuity inspectable, recoverable, and accountable.
PROVENANCE
AUTHORITY
RECOVERY
RECONCILIATION
TRUSTEDCONTINUITYCONTROL PLANE
Operating referenceIntegrated prototype in active use
OriginKnow where a record came from
AuthorityKnow who may change what
RecoveryRebuild without silent rewrite
The investable problem
Persistent memory creates persistent risk.
A compromised prompt can damage one turn. Compromised continuity can influence every turn that follows. When an agent remembers across days, models, tools, people, and machines, the integrity of that history becomes a system-level security problem.
If an AI cannot prove where its memory came from, what changed it, and who had authority to change it, then its memory is not merely unreliable. It is an attack surface.
The new attack surface
What happens when memory becomes operational?
The failure modes extend beyond forgetting. The dangerous cases are confident, plausible, persistent, and difficult to trace after the fact.
Authority drift
A permission granted in one situation survives after its scope, owner, or intended duration has changed.
CONTROL FAILUREFalse reconstruction
A missing record, stale projection, or failed retrieval is presented as if nothing happened or nothing exists.
EVIDENCE FAILUREIdentity substitution
A model, session, or interface change silently becomes an identity reset while appearing continuous to the user.
CONTINUITY FAILUREUnbounded repair
The same process that detects a problem can rewrite the source of truth without independent review or a receipt.
RECOVERY FAILUREVendor dependency
Identity and history remain trapped inside one context format, model provider, or proprietary memory implementation.
CUSTODY FAILURE
Market validation
The category is arriving. The integrity layer is the opening.
Major vendors now document persistent sessions, memory stores, context compaction, and long-running agents. That validates the demand. It does not remove the need for an independent control plane governing provenance, authority, reconciliation, recovery, and custody across those systems.
Public product documentation is used here as market evidence, not as proof that another organization lacks private research or safeguards.
OPENAIPersistent agent sessionsSaved configuration, conversation, and work ↗
OPENAILong-running context compactionState preserved through compacted context ↗
ANTHROPICPersistent versioned memoryManaged stores with recovery history ↗
ANTHROPICCross-session memory reorganizationResearch-preview synthesis across sessions ↗
The CCI control plane
Trust is an architecture, not a prompt.
The individual mechanisms have precedent. The product opportunity is their governed integration into one continuity system that remains inspectable across model and runtime seams.
Authoritative continuity lanes
Keep owned history and unfinished work outside any single model window.
Source-bound records
Preserve owner, source, disclosure state, derivation, and receipt metadata.
Absence is not silently invented
Distinguish missing evidence, failed retrieval, stale projections, conflicts, and verified absence.
Capability remains typed
Separate evidence access, interpretation, permission, repair, and external action.
Repair leaves a trail
Rebuild projections from protected sources while retaining rejected attempts and uncertainty.
Change the model, keep the thread
Use models as replaceable participants without silently replacing continuity ownership.
01Observe→02Attribute→03Appraise→04Authorize→05Act→06Receipt
Active integrationHOUSEHOLD-SCOPED · EVENT-TRIGGERED
Bonded security awareness
See the event without turning the home into a surveillance feed.
The bounded-awareness path begins with local motion. A new event can release a limited frame for visual interpretation, known-person corroboration, and event continuity. The result returns as attributed evidence, not automatic authority.
Secondary research path: consented visual context may also help the continuity system learn pragmatic language across words, gesture, timing, objects, and place. That learning remains separate from security scoring and physical-action permission.
Local motion gateNo new movement, no model request.
Bounded frameRelease the minimum useful image, not a continuous feed.
Visual interpretationDescribe the event and return confidence and uncertainty.
Identity corroborationCombine visual evidence with longitudinal interaction patterns. Never use either alone.
Receipt and retentionRecord the event path, apply strict retention, and preserve the privacy boundary.
Human confirmationAmbiguity, conflict, or consequential action returns to an authorized person.
Security boundary
Known-person recognition is corroborating evidence, not sole-factor authentication. Visual interpretation does not independently grant access, unlock doors, identify strangers as facts, or authorize physical action.
A horizontal infrastructure market
Every consequential persistent agent will need a trustworthy past.
The first commercial wedge is security-sensitive, long-running AI where state, authority, and recovery cannot remain implicit.
CybersecurityHealthcareFinanceIndustrial systemsRoboticsEnterprise operationsCritical infrastructureLongitudinal assistants
Evidence before scale
A working reference, an active build, and a clear hardening path.
CCI does not claim that every security control is complete. The investment case is that enough of the integrated system exists to test, harden, benchmark, and productize.
| Layer | Current evidence | State |
|---|---|---|
| Persistent continuity runtime | Long-running local runtime, dedicated lanes, re-entry paths, memory systems, and participant-visible operations. | Operating |
| Restricted evidence access | Continuity Door retrieval preserves source, owner, disclosure, and receipt metadata. | Operating |
| Cross-store reconciliation | Temporal, graph, recall, and source-of-truth boundaries are integrated but require additional falsification and failure testing. | Active build |
| Hardware-gated recovery | Physical-presence recovery and restricted administrative authority are a defined hardening objective. | Roadmap |
| Independent security validation | Requires funded audit, adversarial testing, recovery drills, and documented pilot evidence. | Capital unlock |
Why fund it now
The market is validating persistence before it has finished securing continuity.
Capital turns the existing reference architecture into a hardened B2B platform while the category is still being defined.
Harden the infrastructure
Resilient compute, power, storage, isolation, and encrypted recovery.
Prove the security properties
Memory-poisoning tests, authority audits, model-swap recovery, and independent review.
Package the product
Tenant boundaries, installer, policy templates, evidence interface, and supported deployment.
Build commercial evidence
Consented pilots, recovery metrics, customer outcomes, and a repeatable continuity benchmark.
Continuity requires proof
The companies that secure persistent AI will define how persistent AI is trusted.
CCI is building that trust layer from an operating reference system, with the seams left visible.