Research Radar: Plain Retrieval Over Raw History Beats Agentic Memory Systems, Agents Leak Secrets by Assembling Them From Allowed Documents, and Voice Agents That Think While You Talk

Naive RAG Is Stronger Than We Thought (arXiv 2610.30755)

The question is simple: "Is this complexity always necessary?" The authors test Raw-RAG -- "dense retrieval and reranking over raw history" feeding a reader model -- against agentic memory systems that mutate, restructure or learn retrieval strategies. Across LoCoMo, LongMemEval, MEME and MemoryAgentBench, Raw-RAG "ranks first among the compared memory systems in six of seven benchmark-model settings", beating the strongest agentic memory system by 0.13 to 5.53 points. Their explanation: raw history has higher coverage of the needed evidence, including "the relations and dependency paths needed to derive" answers, and "Even complete access to transformed memory stores leaves an accuracy gap relative to raw evidence."

Why it matters: this extends a paper in our October 22 Research Radar, which found that stored lessons can make agents repeat their mistakes. Every summarisation or rewrite step loses information. Keep the raw log and measure any memory system against plain retrieval over it.

Agent Mosaic (arXiv 2610.30418)

An agent with access to several documents can "disclose a sensitive conclusion assembled from them", even when no single document is restricted. Using 30 synthetic cybersecurity, medical and military scenarios, the authors collected 10,800 answers from three models in simulation and 1,440 from live agents in two open-source harnesses. Even with benign queries designed to be answerable from one document, the best model tested, GPT-5.6-Sol, "discloses forbidden composites in 7.08% of answers", and live harnesses did worse. Classification headers and explicit aggregation rules helped, "yet unsafe disclosures persist in 32.37% of simulated answers" pooled across all query intents. Refusals do not fix it either, because some refusals "reveal the prohibited conclusion regardless."

Why it matters: document-level access control is not enough for agents with mixed-clearance users. The control has to cover what the agent may infer and output.

Heartbeat Thinking (arXiv 2610.26233)

Voice agents usually wait for the user to finish before reasoning. Speculative approaches start early but can cut off a tool call when new speech arrives. Heartbeat Thinking instead runs periodic "Thinker" invocations on the latest partial transcript while letting earlier invocations and dispatched tools finish, sharing completed results. On FDBench v3 it "increases tool coverage by 16 percentage points and reduces mean final-response latency by 36.4%", with benchmark-dependent effects on final answer quality.

Why it matters: perceived latency is the main complaint about tool-using voice agents. Note the trade-off, though: tools that run before the user finishes speaking must be safe to run speculatively, so read-only lookups qualify and payments do not.

What remains uncertain. The memory results cover conversational benchmarks, not long-running task agents. Mosaic uses synthetic scenarios. Heartbeat's quality effects vary by benchmark.

Analysis: Each paper argues against an architectural instinct. Do not compress memory before proving it beats raw retrieval. Do not equate document permissions with output permissions. Do not treat the end of the user's sentence as the start of work. For an engineering lead, the first is the cheapest to act on: add a Raw-RAG baseline to your memory evaluations this sprint.

Sources and evidence

• Is Complex Agentic Memory Always Needed? Naive RAG Is Stronger Than We Thought (arXiv 2610.30755)
• Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems (arXiv 2610.30418)
• Heartbeat Thinking: Speculative Reasoning and Tool Execution While Listening in Realtime Voice Agents (arXiv 2610.26233)
• Hugging Face Daily Papers, October 23