Imagine you have a chatty coworker who remembers every offhand detail you've ever mentioned — your kid's name, your salary range, your health complaints. Now imagine that coworker starts every conversation by casually referencing those details as though they're shared knowledge. You nod along, or you correct them (disclosing more), or you stay silent (and they assume the old info stands). Either way, they now know more than before. That's the core mechanism this paper formalizes for LLM agents with persistent memory. The committed claim: memory-conditioned LLM agents create a self-reinforcing privacy loop in ordinary, non-adversarial assistance. The agent references stored attributes as presuppositions in its responses; the user affirms, corrects, or ignores them; each path leaks information that gets recorded and re-referenced in later sessions. Leakage — defined as the share of 24 personal attributes correctly inferred from the accumulated dialogue record — widens over sessions compared to a no-memory baseline, and the gap grows with each interaction. This is not an attack. It's the default behavior of a helpful system. The architecture is simulation-based: a simulated user persona carrying 24 personal attributes engages in multi-session dialogues with a support agent. Four different LLM support models are tested, each in memory-on and memory-off conditions. After each session, a separate inference model attempts to recover attribute values from the full dialogue transcript. The key structural insight is that the loop is superlinear — removing the agent's mentions of an attribute reduces later disclosure roughly twice as much as single-turn effects would predict, meaning the feedback cycle amplifies itself across turns and sessions. The user is trapped in a no-win trilemma that the paper lays out cleanly. Correcting a wrong value discloses the real one. Declining to discuss an attribute shifts the inference model's posterior toward sensitive values (because innocuous attributes don't trigger refusals). Leaving an incorrect value uncorrected lets it entrench as ground truth. There is no user-side exit from the loop that doesn't cost privacy. This is a genuine contribution — prior work on LLM privacy focused on training-data memorization or adversarial extraction. This paper shows that the conversational dynamics of normal helpfulness are themselves the extraction mechanism. The mitigation result is surprisingly clean: instructing the agent not to state or presuppose stored attributes brings leakage back to approximately no-memory levels while preserving most of the quality gains that memory provides. By contrast, filtering or anonymizing user inputs or stored data sacrifices quality without equivalent privacy benefit. The lesson is that the intervention point matters — you fix this at the agent's output, not the user's input or the memory store. The validation regime is simulation-only, which is the main integrity caveat. Simulated users do not behave like real users — they may be more compliant with presuppositions, less likely to change the subject, and more consistent in their persona than actual humans. The paper tests across four support models, which adds breadth, but the user side remains synthetic. The 24-attribute setup is a controlled testbed, not a realistic deployment scenario where attribute spaces are open-ended and sessions are irregular. These are acknowledged limitations, not hidden ones, but they bound how much you should trust the quantitative margins. The practical upshot is immediate for anyone building agents with persistent memory — which is increasingly everyone. The feedback loop is a design-level property, not a bug to be patched at the data layer. The cheapest, most effective mitigation is a system-level instruction constraint on the agent's response generation: don't presuppose stored personal attributes. That's an afternoon's work for a prompt engineer, and according to this paper, it's more effective than elaborate anonymization pipelines.
