AI Persistent Memory: ChatGPT Dreaming and the Cross-Session Context Race

OpenAI launched Dreaming V3 for ChatGPT on June 4, 2026 — a background synthesis system that continuously updates user memory from conversation history rather than storing static snapshots, rolling out first to Plus and Pro subscribers [1][2]. Startup Anuma is positioning as a cross-model portable memory alternative, arguing proprietary per-model memory forces users to carry context manually [10][9]. The security dimension of persistent AI memory has grown concrete: Sysdig documented the first publicly known LLM-agent-driven post-exploitation chain in May 2026 [12], SecurityWeek published a formal benchmark ranking security posture across 100 AI agents [13], and practitioners have flagged that self-evolving agents may void their own prior safety reviews [15].

How AI assistants handle persistent memory is becoming a key axis of platform differentiation. OpenAI's Dreaming locks richer context into ChatGPT specifically, while Anuma's portable model treats memory as user-owned infrastructure spanning all models — the two approaches carry different implications for user lock-in and platform economics. The security risks are no longer purely theoretical: documented real-world LLM agent exploitation and the observation that continuously self-updating systems may not match the version originally safety-reviewed make persistent memory both more capable and harder to secure.

On June 4, 2026, OpenAI announced Dreaming — internally versioned as Dreaming V3 — a redesigned memory architecture for ChatGPT that runs background synthesis processes to keep user context current rather than relying on explicit, static memory entries [1][2]. The system rolls out first to Plus and Pro subscribers. OpenAI's framing positions it as a move from passive storage to proactive synthesis: the model periodically reviews conversation history and updates what it knows about a user's preferences and goals [1]. The announcement drew rapid social amplification within hours [3][4][5].

The Dreaming launch sits in a broader practitioner context. Hacker News discussions from late May described 'compaction amnesia and context rot' in AI coding tools — the pattern where models progressively lose track of prior decisions in complex, multi-step workflows [6]. Developer forum posts argued that structured selective memory retrieval is more reliable than extending context windows [7]. MIT's MeMo system, circulated in late May, reported a 26% LLM performance improvement by keeping memory architecturally separate from the base model [8]. A competing architectural philosophy has emerged from Anuma, a startup building cross-model portable AI context [9]. Rohan Paul described the core problem: 'Most AI workflows break because the user has to carry the context manually' [10]. Anuma stores context in a format portable across ChatGPT, Claude, and other systems — user-owned infrastructure rather than platform-locked memory.

The security dimension of persistent AI memory has moved from theoretical to operational. Palo Alto Networks documented that indirect prompt injection can poison AI long-term memory, causing persistent behavioral changes across sessions [11]. Sysdig documented the first publicly known LLM-agent-driven post-exploitation chain in May 2026, confirming that AI agent vulnerabilities are being exploited in the wild [12]. SecurityWeek published a benchmark formally ranking the security posture of 100 AI agents [13], and CrowdStrike identified indirect prompt injection as a primary attack category against AI systems [14]. A structural concern has also emerged in practitioner commentary: Danny Livshits observed that a self-evolving agent voids its own safety review, since the version tested is not the version running a month later [15] — a problem that background-synthesis systems like Dreaming make more acute. None of the major providers have publicly addressed how they intend to handle persistent attack surfaces or the safety-review validity problem for continuously updating memory systems.