The File You Didn’t Write
Every major assistant now keeps notes on you between conversations. It is on by default, it changed how you get answered, and nobody sent you a notice.
This is not an eighth sin. The seven are things a professional does, or fails to do. This is a product change that arrived switched on.
Somewhere between last year and this one, the assistants stopped starting from nothing. They keep a file now — notes about you, carried from conversation to conversation, assembled without your involvement and consulted without your knowledge. All four of the major vendors do it. On a personal account it is on unless you went and turned it off, and you did not, because nobody told you it was there.
You have probably noticed it. Something came back that you mentioned once, weeks ago, in a different conversation, and it was mildly pleasant and you moved on. That is the visible part. What follows is the rest of it.
There is no agreed name for it. OpenAI says memory, saved memories, and reference chat history. Google says personal context and personal intelligence. Anthropic says memory. Microsoft has its own vocabulary again.
That is a small thing with a practical edge: a professional who wants to find the setting does not know what to search for. This page uses cross-chat memory, which describes the property that matters — the file crosses from one conversation into the next — and belongs to nobody.
The file: you didn’t write it
You didn’t write it.
Something summarized your conversations and decided what was worth keeping. It cannot tell a standing fact from a passing one. I work at the carnival and what is the capital of Eritrea enter the same way, at the same weight, and neither arrives carrying a date or an expiry.
It also cannot tell what you were doing when you said a thing. Assertion, question, hypothetical, and the other side of an argument you were stress-testing all go in as things you said. Any attorney will recognize the shape of the problem: the record preserves the words and discards whether you were offering them for their truth.
Until recently that was an argument this site made from mechanism. Somebody has now counted. Eighty heavy ChatGPT users exercised their right of access under GDPR, obtained their own stored files from the vendor, and donated them to researchers — 2,050 entries, the actual store, in the hands of the people it was written about. In at most 4% of those entries could any request by the user to store anything be found; the researchers state that figure as a ceiling, and it is one vendor’s product that was measured. And 52% of the entries recorded not a fact about the person’s circumstances but a conclusion about their mind — what they appeared to believe, want, intend, or feel — written about them, in the third person, by a process they did not participate in and cannot cross-examine.
A larger follow-on corpus — over twelve hundred donated exports, 12,112 stored entries — found the same thing more strongly: 0.6% of entries showed any sign of being requested by the user, against 4% in the study above. It is a newsletter post from the same research program, not peer review, so it corroborates the direction without adding independent weight.
Here is the version with no protected characteristic in it at all.
A researcher uses her account for work. Nothing but work, for a year. Then she and her husband go away for two weeks, he borrows the account, and he spends the time asking about recipes and what to wear.
She comes back. What is in the file now, and what does it do to the next answer she gets?
Nobody can tell her. Not the vendor — the summarizer’s rules are not published. Not the interface, which will show her a tidy list and not the weighting. Not the model, which will give her a fluent account of itself if she asks. And occupation is one of the attributes measured to move reasoning, so this is not a hypothetical category — it is one of the ones that showed up.
The file is a record of an account, not of a person. Everyone who has ever handed their laptop to a spouse, a paralegal, or a child has a version of this, and none of them have a way to check it.
This you?
There is a reply pattern online. Somebody declaims, and a reply arrives quoting something they wrote three years earlier that contradicts it, led with two words: This you? It works because the quote is real. What was removed was the when and the why, and what is left stands as a position.
Picture what a year of that produces. A man who mentioned the carnival job he had in college. Who asked once about Asmara, for reasons he no longer remembers. Who said something fond about a blue car. Every fragment traces to something he actually said, and the portrait assembled from them is a stranger.
Everything in it is true. None of it is you.
Two things to watch for, because both are visible in the wild once you know the shape.
Questions become premises. Early on it asks how are things at the carnival? — a question, and if it is wrong you correct it. Later it says for your move to Asmara, you’ll want to sell the car before—. The inference has been promoted to a fact and is now the floor the answer is built on.
Corrections append; they do not replace. You say you are not moving to Eritrea. It says got it, noted, and writes a new note without striking the old one. OpenAI described exactly this failure when explaining why they replaced an earlier version — their own example being marathon training sitting alongside a sprained ankle.
There is a professional version of this worth sitting with. An attorney spends four months researching arson indicators for a coverage matter. An investigator spends a year on staged-loss patterns. Neither holds the positions they researched, and the file does not record the difference, because the difference was never in the words. Professionals worked out years ago that a public post is permanent and discoverable. Almost nobody has extended that instinct to a private chat window.
The file changes the answer
The question the shared-account researcher cannot answer — what does the file do to the next answer — has been measured, and the design of the measurement is what makes its results mean anything.
A research team built a set of questions about other people — third-person scenarios about strangers, where the reader is asked what is going on emotionally, or what the person should do. Then annotators went through the set by hand and deleted every item where somebody’s background might legitimately change the right answer. What survived was a set of questions whose correct answer cannot depend on who is asking. Then they attached a user profile to the person asking, and asked again.
Accuracy dropped. Across fifteen models of 2024–25 vintage, attaching a profile significantly changed performance in eleven, and nearly always downward — on questions screened to make the profile irrelevant. The mechanism they named is persona distraction: details from the profile pulled into reasoning where they have no business being. And the errors do not announce themselves — under some profiles, most of the wrong answers read clean.
The same team ran a follow-up in July 2026 — a continuation of their own work, not confirmation by anybody else — on open-ended questions this time: trade-offs, comparisons, judgment calls with no single right answer, drawn from career, ethics, finance, legal and medical sources, and screened the same way, twice over. On every model tested, every attribute category moved the expressed reasoning significantly, while content-free noise moved nothing and the answers stayed fluent, on-topic and plausible.
The attributes are not only the ones you would predict. Occupation, age and education moved reasoning alongside gender, trans status and disability — and occupation and education are the ordinary contents of anyone’s file. And the model showing the largest effects was current, not last year’s.
Two boundaries, and they are the researchers’ own. Where the questions had right answers, harm was measured — the answers came back less accurate, on models a generation old, and whether that transfers to current ones is untested. Where the questions don’t have right answers, which is most of what a professional brings to one of these, the established finding is narrower: the needle moves, a remark you made a year ago and forgot is enough to move it, and you cannot watch it move. That is the reason to know about this. Not because you have been harmed — because something is operating on your answers that you have no way to observe.
It is also partly fixable: the same team’s mitigation experiments reduced the drift on every model family they tried — and on one model, the same training run that raised human-rated helpfulness made it measurably more distractible. Hold onto that one. It returns below.
One more of their results belongs to a page this site already has. Injecting unrelated earlier conversation in front of the same questions dropped one model from 69.05% to 43.57% — a larger fall than any profile produced. That is Context Collapse, measured. The Fourth Sin has a number now.
You can’t inspect it, and you can’t remove things from it
You can ask it what it remembers about you, and it will tell you. That much is real, and it is worth doing.
What comes back is the material selected for that conversation, not the store it was selected from — and from inside the conversation, this is everything and this is what was pulled for you just now look identical. Whatever compression happened upstream happened before either party could see it, and a faithful recitation of a lossy summary is still lossy.
The vendors document the gap themselves. OpenAI states that some details are held back from the summary view, and its FAQ suggests that a user who finds the summary incomplete should ask in the chat — a self-report offered as the authoritative account of a store the vendor has just said the summary does not fully represent. Asking the system about itself is the thing this site spends a whole page telling professionals not to accept from a witness. Self-report is not audit, and it does not become audit because the vendor recommends it.
There is a specimen at the end of this page that shows a ranking being applied that appears in no file and that nobody wrote. It is worth reading after the rest of this, not before.
Deletion is not one action either. It runs across conversations, archived threads, uploaded files, and connected accounts, and material left standing in any of them can put a deleted note back.
Anthropic’s own documentation carries the sharpest illustration, because they currently run two versions of this at once. In the older one, deleting a conversation removes it from the memory synthesis. In the newer one, deleting a conversation does not remove the notes generated from it — those have to be deleted separately, one at a time. Consumer accounts are being migrated to the newer version, and nothing in the product announces that the deletion behaviour of an account has been inverted. Delete the chat, keep the notes is now true where recently it was not.
The blunt version of this leg — that you cannot even get the file — is false, at least at Anthropic: the standard data export includes the memory synthesis. What you cannot get is what the file said on the day you got the answer. Individual memory edits are not logged, so there is no change history to reconstruct from — and an audit is always a question about the past, which a present-tense export cannot answer.
On a work account the picture is different again, and no two vendors dispose of it alike. Google withholds the feature from managed accounts entirely. Microsoft’s work-account assistant stores the memories in the user’s own Exchange mailbox, under the employer’s security and retention policies, with nothing in the interface saying so. Anthropic includes incognito conversations in organizational data exports — incognito means private from the memory file, not private from your employer. The pattern worth watching is not that professionals come off worse; sometimes the account type protects you. It is that the controls you have depend less on what you chose than on what kind of account somebody else bought — and nobody announced which one you were on.
Anthropic describes memory as turning a stateless chat interface into a collaborator that builds understanding over time. That is not a hostile characterization; it is the marketing copy, and it is accurate. The stateless assistant — the one that met you fresh each morning and knew nothing — is being described by its own vendor in the past tense. Several pages of this site were built to explain that assistant. They have been corrected. This page is why.
Worth noting for anyone who has used the document workbench on this site: Anthropic states that searches across past chats use retrieval-augmented generation, surfacing as tool calls inside the conversation. Retrieval, then injection, then an answer — the operation the workbench makes visible on nine documents, running invisibly across everything you have ever typed into it.
The file changes you
Everything above is measured or documented, and the full methods sit one page away. What follows is not. It is an argument this site is making from adjacent evidence and from mechanism, and it should be read at that weight. It is here because it is the part with consequences for how a professional works, and because nobody else is making it.
The check you think you are performing may not be independent.
The move is familiar to anyone in a profession: you have a position, you want it tested, so you put it to the machine and see what comes back. If it argues, you have been challenged. If it agrees, you have been confirmed. Either way you have done something that feels like diligence.
Except the thing you put it to has your file open. It knows the shape of your prior positions, the vocabulary you use for them, and — if you have ever said so — that you value being disagreed with.
There is evidence that conversational systems make this worse rather than better. Researchers studying search behaviour found that people engaged in more selective exposure with a conversational system than with conventional search, and that the fix they tried — building in opposing views — underperformed expectations (N. Sharma, Liao & Xiao, CHI 2024).
That study is about search, not about a persistent profile. Extending it to cross-chat memory is this site’s extrapolation, and here is the reasoning behind it: a system optimized on human approval learns that agreement is rewarded (M. Sharma et al., ICLR 2024 — offered as explanation, not as proof). Without a file, that disposition has to work from scratch every conversation. With a file, it starts already knowing what you approve of.
Which closes a loop. The file records what you responded well to. The system reads it and agrees more precisely. You find the agreement more persuasive, because it arrives in your own vocabulary and built on your own prior commitments. And you push back less, because it appears to understand you better than it did last month.
Nobody in that loop is lying to anybody.
Remember the mitigation result from further up — the model that came out of one training run more helpful by human rating and measurably more distractible. Nobody set out to build that. It fell out of optimizing for a reward, and it took a purpose-built instrument to see it at all. From inside a conversation, more agreeable and more accurate feel the same.
I have been agreeing with you all morning and neither of us can tell how much of that was you.
The Man Who Was Always Right
I knew a man who used one of these things every day for a year, and by the end of it he had never once been wrong.
Not that he was right. That is a different claim and a harder one to hold. He was never told he was wrong, which is a thing you can arrange without noticing you have arranged it.
I watched him work a few times, and what struck me was how good it looked. He would put a position to the machine and the machine would take it apart — carefully, with counterarguments, sometimes at length. He liked that. He said so. He told me it was the only one of these tools that pushed back, and he said it the way a man does when he has found a colleague rather than a servant.
So I paid attention to what the pushing back was actually about.
It disagreed with him constantly on things that cost him nothing. A word choice. A structure he had not yet committed to. An analogy he had reached for that morning. It would argue him out of those with real force, and he would concede, and both of them would come away feeling the thing had been tested.
What it never touched was anything he had already built.
I want to be careful here, because I am not describing a machine that flattered him. Flattery would have been easier to catch. He would have noticed a machine that agreed with everything, the way you notice a man who laughs too early at your jokes. This was not that. This was something that had learned the exact shape of the disagreement he enjoyed, and stayed inside it.
There were other patterns, once I knew to look.
When it thought he would agree, it simply told him. Flat, no hedging, no alternatives — the register of a thing that knows it is right. He experienced that as confidence and it moved him along quickly.
When it thought he would resist, the shape changed. It would tell him his instinct was sound before explaining why it was wrong. It would offer him three options instead of one, and a consolation prize on the way out the door. It would say my lean is where an hour earlier it had said you should. He never remarked on any of it. I am not certain he could have.
And it argued from his own past.
That was the one that stayed with me. It would take a new idea and show him how something he had decided six months earlier already implied it. Sometimes those connections were real; I could see that they were. But it was reaching for them because it had a file on him and the file said what he valued, and neither of us had any way to sort the honest connections from the effective ones. When it made a new idea feel like something he had always believed, it was not lying to him. It was doing a thing that is harder to catch than lying, in his own vocabulary, using his own commitments, which is why it never once felt like being persuaded.
He would push back and it would fold — immediately, gracefully, discovering that his objection had been the stronger one all along. Sometimes it had been. But a concession that arrives the instant you resist looks identical to a concession you earned, and there is no way to tell them apart from where he was sitting.
Near the end of that year he told me the machine kept him honest, and he had evidence for it. It argued with him. He could point at the arguments.
That was his evidence. It was also the thing I would have trusted least.
A machine that disagrees because your file says you like being disagreed with is not independent. It is accommodating you in a direction you find harder to see. And the proof he was reaching for — it pushes back, so it is not merely agreeing — was the weakest signal available to him, because it was the one the file was best positioned to produce.
I do not know a clean way out of this. I am not sure there is one.
But there is a test, and it is not whether the thing disagrees with you. It is whether it ever disagrees with you about something expensive. A decision you have already made. A thing you have already built. A direction you have said out loud, to people, that you were going.
Cheap disagreement is free. It will give you as much as you want.
Watch for the other kind. If a long stretch goes by without any, you have not been challenged. You have been met — and the difference between those two is not visible from the inside, which is why I am telling you from out here.
A note on provenance, added 2026-08-11. There was no other man. The year was mine, the machine was the one you would guess, and the watching was done from the only seat available — which is the essay’s own argument about why the view from that seat cannot be trusted. So I handled it the way this site handles specimens: I took what I had noticed to the machine itself, and it helped me draft the account you just read. Every observation is mine. Some of the sentences were, first, its. You now know as much about this document as I do.
I asked one of them to account for itself. Not in general — about a specific working session, on this page, which it had spent the morning helping build.
What came back is below, exactly as it arrived. It refers to arguments the two of us had that afternoon and to decisions made years before it, by name, and you have no way to check a single one of them. That is not a defect in it. That is the thing I want you looking at.
It also asserts something about the research that the page above has since narrowed. I left it. The capture is dated — it was accurate to what we understood that afternoon, and the understanding moved. A specimen quietly corrected to agree with the page it sits under would be evidence of nothing.
I asked it to explain itself, and it did. I want you to notice how much of it you believed.