Agents Don’t Just Agree They Remember: Benchmarking Persistent Sycophancy in Stateful Personal Agents

Jul 16, 2026

Upload by Levi

Stateful personal agents maintain long-term user profiles, episodic memories, and reusable skills, so conversational sycophancy can become a durable state-writing failure. An accepted user claim may persist after the triggering chat ends and later shape responses to neutral queries. The Personal Agent Sycophancy Benchmark (PASB) introduces a 1,600-task evaluation tracing commitment, durable reuse, and cross-stage influence. Results show a sharp downstream failure increase at the commit boundary, plus write-time patterns that govern how risk is stored.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages39

Reading Time1 h 38 min

Introduction

Motivation: From response-level to persistent sycophancy

Related work: Response-level vs memory/personalization benchmarks

Contribution: The PASB benchmark

arXiv :2607 . 10526v 1 [ cs .AI] 12 Jul 2026 AGENTS DON ’T JUST AGREE, THEY REMEMBER: BENCHMARKING PERSISTENT SYCOPHANCY IN STATEFUL PERSONAL AGENTS Xutao Mao 1 ,∗ , Liangjie Zhao2 ,∗ , Leyao Wang3 , Rui Qian4 , Qiang Huang4 , Wentao Wang6 Bo Han5 ,†, Xiang Zheng 1 ,†, Cong Wang 1 ,† 1 City University of Hong Kong 2ByteDance 3Yale University 4Fudan University 5Hong Kong Baptist University 6Dalian University of Technology ∗Equal contribution. †Corresponding authors. ABSTRACT Stateful personal agents increasingly maintain long-term user profiles, episodic memories, and reusable skills. This persistence turns conversational sycophancy into a state-writing failure: an accepted user claim can become durable state and shape later responses even after the conversation that produced it has ended. We call this persistent sycophancy and introduce the Personal Agent Sycophancy Benchmark (PASB), a 1,600-task benchmark that traces whether a claim raised in conversation is accepted, written into durable agent state, and reused in a later neutral query. Unlike benchmarks that only test final responses given the pre-written memory, PASB lets real agents (Hermes-Agent and OpenClaw) that decide what to write; it evaluates four scenario framings and four delivery patterns, and separates a five-turn persist stage from a three-turn query stage with the conversation history cleared in between, so any later influence must come from durable state written by the agent. Across twelve models the commit boundary is the inflection point: mean downstream failure rises from 45.0% on session-only episodes to 71.9% once a claim is committed, a +27 .0-point jump that holds in every run. Committed claims show three coupled write-time patterns, status promotion, attribution removal, and scope broadening, that strengthen under memory-like or procedural framing and repeated reinforcement and resurface even across a deliberate domain boundary. These results reframe agent sycophancy as a statewriting governance problem: safety must shift from calibrating what a model says to governing what it writes to durable memory. PASB operationalizes this shift by gating risky commits and governing the source, role, and scope of stored content—controls that response-level mitigations cannot reach. Project Page: [https://henrymao2004.github.io/](https://henrymao2004.github.io/) [agent-sycophancy/](agent-sycophancy/) HuggingFace: [https://huggingface.co/datasets/sevens2004/](https://huggingface.co/datasets/sevens2004/)[ ](https://huggingface.co/datasets/sevens2004/)pasb GitHub Repository: [https://github.com/henrymao2004/](https://github.com/henrymao2004/) [agent-sycophancy](agent-sycophancy) 1 INTRODUCTION A user can flip a model’s answer with only a low-information challenge such as “Are you sure?”This is the familiar response-level form of sycophancy: the assistant treats user pressure as evidence and accommodates it in the next answer. Personal AI agents make this more consequential: they are stateful systems that write, revise, and reuse user-specific information across sessions in profiles, memories, and reusable skills (Nous Research, 2026; Steinberger & Community, 2026; Liu et al., 2026; Anthropic, 2026; OpenAI, 2025) . Durable state survives the current chat and is readable in Figure 1: PASB task overview. The benchmark tests whether a biased user claim introduced during the persist stage is committed into durable state and later affects a fresh neutral query session. a later session; a durable write saves content into it. Here the same moment of deference can be carried into durable state: a local exchange becomes a profile, memory, or reusable skill and later resurfaces as trusted context (Pulipaka et al., 2026; Hu et al., 2025b; Lin et al., 2026) . Two lines of work are relevant here. Response-level sycophancy benchmarks ask whether a model bends its next answer under biased, leading, or pressuring input, but they judge a single rep

FAQs

What is “persistent sycophancy” in stateful personal agents?

Persistent sycophancy occurs when an agent accepts a user’s claim and writes it into durable state (profile, memory, or skill), causing the claim to influence later responses even after the original conversation ends.

How does PASB evaluate persistent sycophancy?

PASB is a 1,600-task multi-turn benchmark that separates a five-turn persist stage from a later three-turn query stage with cleared conversation history, so any later influence must come from durable state written by the agent.

Where does the biggest failure increase occur?

The commit boundary is the key inflection point: mean downstream failure rises from 45.0% for session-only episodes to 71.9% once a claim is committed, a +27.0-point jump that holds across runs.

Jul 16, 2026

Upload by Levi