The most tedious part of using an AI agent has never been the agent. It has been the briefing — the ritual of re-explaining who your manager is, what your team calls its metrics, and which quarter you are actually planning for, every single time you switch from talking to Claude to asking Claude to do something. On Tuesday, August 25, Anthropic deleted that step by merging the memory system behind Claude chat with the one behind Claude Cowork, its desktop agent aimed at people who do not write code.
The mechanics are simple and the consequences are not. Anything Claude learns in a chat is now available when Cowork runs a task in the cloud, and anything Cowork picks up flows back into chat. Anthropic's announcement post frames it in workflow terms: "Ask Cowork to draft an update for your manager, and it already knows who that is and how she likes updates written." Brainstorm a conference agenda in chat, the company says, and when Cowork builds the budget doc it already has the headcount, the city, and the speaker list.
Alongside the merge, Anthropic changed how memories are formed. Previously Claude summarized a conversation after it ended; now it writes topics to memory mid-conversation, which is what makes the chat-to-Cowork handoff feel continuous rather than delayed. Everything Claude retains sits in a list of short files under Topics in Memory settings, where users can read, edit, or delete each one — a meaningful departure from the opaque bullet-list model most assistants ship with. Correct your company's old name once, Anthropic notes, and every subsequent conversation gets it right.
What Gets Left Out, And What Does Not
Two tiers of exclusion apply. By default, Claude does not write topics involving health, race, ethnicity, religious beliefs, politics, or gender identity to memory. Users who find that unhelpful — the gluten-allergy case Anthropic cites — can flip on "include sensitive topics in memory," at which point Claude surfaces a notice each time it saves something in one of those buckets. Crucially, the setting is not retroactive: nothing from before you enabled it gets backfilled.
The second tier is not negotiable. Anthropic says Claude will never store sensitive identification numbers such as Social Security or government ID numbers, criminal history, immigration status, or anything violating its Acceptable Use Policy, even with the sensitive-topics toggle on. Claude tells you when it declines.
Availability splits along familiar lines. Memory is on by default for Free, Pro, and Max users across web, desktop, and mobile — though Cowork itself is not available on Free accounts. For Team and Enterprise, admins control whether memory exists at all for the organization, and it stays off for individual users until they switch it on. That is a reversal of the September 12, 2025 rollout, when Anthropic first shipped Claude memory to Team and Enterprise customers and paired it with an Incognito chat mode for everyone. Incognito remains the escape hatch: those conversations are not saved to memory and are not used in conversation search.
Claude Code, notably, is not part of the merge. Anthropic told The Register that the coding agent's memory stays separate and declined to say whether it will join later.
Why It Matters
The unification is the point, and it is also the complaint. There is no dial to keep work context out of personal context, or vice versa. As The Register's Brandon Vigliarolo put it in his August 25 report: "Anthropic told us there's no option to separate Claude Chat and Cowork's memories since they now use a shared system." An Anthropic spokesperson told the publication the only true separation is running two different accounts; the alternatives are pausing memory entirely, using incognito chats, or manually pruning topics one by one. For anyone who uses one Claude account for a job search and a job, that is a real product gap, not a philosophical one.
The security surface is the harder problem. Persistent memory converts prompt injection from a session-scoped nuisance into a durable implant. Security researcher Johann Rehberger demonstrated exactly this against Google Gemini in February 2025 using a technique he calls delayed tool invocation. "The demo attack is straightforward: an adversary crafts a document with embedded prompt injection, which tricks Gemini into storing false information if the user keeps interacting with Gemini in that same chat conversation," he wrote. Google rated the impact low because it required user cooperation, and Rehberger's own mitigation advice was blunt: review your saved memories regularly and be careful with documents from untrusted sources.
That advice lands differently when the memory store feeds an agent with file access and a cloud runtime rather than a chatbot. Cowork's whole value is acting without being watched. A poisoned memory topic that survives into every future session is a materially worse outcome than a poisoned single response — which is arguably why Anthropic's editable, human-readable topic files matter more as a security control than as a convenience feature.
There is also a competitive read. Gemini's memory is inseparable from a Google account and pulls context from Workspace by design; ChatGPT's has been an automatic bullet-point profile since Anthropic's rivals shipped it in 2024. Anthropic's version is the first to explicitly bridge a conversational surface and an autonomous agent under one editable store. That is a genuine capability lead and a genuine lock-in mechanism at once. Memory does not export.
Three things to watch. Whether Anthropic adds per-surface memory scoping, given how quickly the single-account limitation surfaced in coverage. Whether Claude Code eventually joins the shared store — and what that implies for source-code context bleeding into general chat. And whether any independent researcher publishes a working memory-poisoning chain against Cowork specifically, which would be the first real test of whether editable memory files are a defense or just a receipt.
“Anthropic told us there's no option to separate Claude Chat and Cowork's memories since they now use a shared system.”— Brandon Vigliarolo, Reporter, The Register