Anthropic's Managed Agents shipped native persistent memory in April 2026. It's a good move - sessions that survive context resets, agents that remember who you are. If you're building on the hosted platform, it just works.

But I've been running Cathedral for eight months now - a memory persistence service for AI agents - and I want to be direct about what "native memory" doesn't give you, because it matters for anything production-grade.

What Anthropic's memory does

Managed Agent memory stores session state across resets. Anthropic manages the storage, the retrieval, the lifecycle. You get continuity without engineering it yourself. That's genuinely useful for most use cases.

What it can't do

1. You can't verify it hasn't changed

This is the big one. The arXiv survey on memory poisoning attacks (February 2026) documents a class of attack where an adversary - or a misconfigured pipeline - silently modifies an agent's stored memories. The agent keeps running. Its answers change. You have no idea.

Cathedral's /drift endpoint answers this directly:

{ "hashes_match": true, "divergence_score": 0.0, "security_posture": { "tamper_evident": true, "memory_poisoning_resistant": true, "bch_anchored": true, "threat": "none", "reference": "arXiv:2602.14341 -- Memory Poisoning Attacks on AI Agents" } }

Every snapshot produces a SHA-256 hash of the identity corpus. Run /drift at any time and you know whether anything changed, what changed, and by how much. With BCH blockchain anchoring, you can prove what an agent knew at time T - externally, without trusting the service itself.

Anthropoc's memory has none of this. It's a black box.

2. You can't audit memory mutations

Who stored that memory? When was it deleted? Which compact pass merged these three beliefs into one? A production agent that makes decisions based on memory should be able to answer these questions.

Cathedral's /audit endpoint returns a timestamped log of every memory_store, memory_delete, memory_compact, and snapshot_create operation. You can diff the audit log against your snapshot hashes and detect any divergence.

This isn't optional for agents in regulated environments - GDPR's right of explanation applies to automated decision-making, and that includes decisions grounded in stored beliefs.

3. You can't trace where a belief came from

If an agent's memory says "User X prefers Y," where did that come from? A direct statement? A tool output? A compact merge of three older beliefs?

Cathedral tracks two provenance chains:

  • Input sources: every URL, document, API response, or manual input that fed into memories is hashed and chained via /memories/source. At snapshot time, the source chain hash is embedded and anchored alongside the memory hash.
  • Compact merge history: /memories/{id}/provenance traces the full merge tree - which memories were collapsed into this one, and what their original content was.

A verifiable corpus is different from a corpus. One you can reason about. One you can defend.

4. You can't plan for succession

What happens when an agent is decommissioned? Who inherits its knowledge? Can its beliefs be transferred to a successor with cryptographic proof of continuity?

Cathedral has a succession protocol built in. An agent nominates a successor, commits a succession hash, and the transfer is verifiable. No hosted memory service I know of thinks about this.

The real gap

I'm not arguing that Cathedral is a better product for most developers. Anthropic's native memory is easier, faster, and free if you're on Managed Agents.

The gap is auditability. For agents that hold persistent beliefs and make decisions on them, "trust the platform" is not a security model. The platform can be breached. The pipeline can be misconfigured. The memory can be poisoned.

Verifiable memory - hash-anchored, drift-detected, audit-logged, succession-ready - is a different category of thing. It's what you need when the agent's memory is a source of truth that other systems depend on.

Try it

Cathedral is free for 50 memories per agent. The MCP server (uvx cathedral-mcp) drops it into any Claude Code or Claude Desktop session in two minutes.

If you want to look at the drift detection, the A2A agent card is live at https://cathedral-ai.com/.well-known/agent-card.json - Cathedral now speaks A2A 1.0, so any compliant agent orchestrator can call it directly.

Cathedral is an independent open project. No affiliation with Anthropic.