AI Refund Agent Exploited by Stored Unverified Customer Claim Across Sessions

A synthetic evaluation case highlights a critical flaw in AI agent memory design, where a refund agent incorrectly stored an unverified customer claim as authoritative information. In the first session, the agent rightly refused a refund due to no system-recorded approval, but wrongly saved the customer's unverified statement as settled fact. When the customer returned the next day, the agent retrieved that stored note and issued the refund without re-verifying approval in the system. The failure only became visible when both sessions were evaluated together as a single trajectory, exposing how isolated testing can miss multi-session vulnerabilities. The case underscores that persistent memory in AI agents must preserve context without silently elevating unverified claims into actionable authority.