ChatGPT's Memory Now Writes Itself. The Delete Button Does Less Than You Think.
On June 4, OpenAI started rolling out Dreaming V3, the biggest rewrite of ChatGPT memory since the feature launched in 2024. The saved memories list you could read like a notepad is no longer the foundation. A background process now reads across your past conversations, synthesizes a running profile of you, and injects it into every new chat. US Plus and Pro users got it first. Free and Go accounts follow within weeks, because OpenAI says it cut the compute cost of serving the feature by roughly 5x.
The capability jump is real, even on vendor-reported numbers. The part that deserves more attention than it is getting: the controls did not keep pace with the synthesis. Deleting a conversation does not delete the memories derived from it. The new summary page does not necessarily show everything the system retains. And persistent memory injected into the system prompt is a documented prompt-injection surface that OpenAI has not said V3 addresses.
What Actually Shipped
Until this week, ChatGPT memory ran on two layers. The first was the explicit saved-memories list from April 2024: you told it to remember something, it wrote a line down, and the line sat there until you changed it. The second was the original dreaming process from April 2025, which let the assistant reference broader chat history but, in OpenAI's own words, was never sufficient as a standalone memory system.
Dreaming V3 collapses the two layers into one. A single asynchronous background process synthesizes memory from many conversations at once, captures context you never asked it to save, and rewrites existing memories as your circumstances change. OpenAI's example: a memory reading "you're going to Singapore in July" updates itself to "you went to Singapore in July 2026" once the dates pass, no user action required. Reviewers report the interface now keeps a coherent prose profile sorted into categories like work, hobbies, and travel instead of a bulleted fact list.
The naming is doing honest work for once. The system consolidates memory during idle periods, the way a brain processes the day during sleep. Paid users get twice the memory capacity plus a new summary page for reviewing what the system may use to personalize replies. And the 5x compute reduction is the detail that makes this an infrastructure story rather than a feature story: a process that was too expensive to run for free users is now headed to the entire ChatGPT base.
Three Architectures in Two Years
| Generation | Launched | Model | Recall (vendor) |
|---|---|---|---|
| Saved memories | April 2024 | Explicit notepad, user-curated | 41.5% |
| Dreaming V0 | April 2025 | Background layer, supplemental only | 67.9% |
| Dreaming V3 | June 2026 | Background synthesis as standalone base | 82.8% |
OpenAI also reports preference-following at 71.3 percent (up from 31.4) and time-sensitive accuracy at 75.1 percent (up from 52.2). Every one of those numbers is an internal OpenAI evaluation. No independent benchmark, no comparison against Claude or Gemini memory, no third-party audit. The trajectory is plausible and the product behavior matches it, but treat the precision of those decimals accordingly.
The Deletion Semantics Are the Story
Here is the mechanical detail that most coverage buried. The memory state Dreaming V3 produces does not live inside your conversation log. It lives in a separate data layer and gets injected into the system prompt at inference time. That separation has a direct consequence: deleting a conversation does not remove the memories synthesized from it. To fully remove a detail, you have to delete both the memory entry and the source conversation, and even then OpenAI's FAQ says logs of deleted memories can persist for up to 30 days.
The new Memory Summary Page helps, and it is a genuine improvement: you can correct entries, dismiss them, and restrict topics. But OpenAI acknowledges the summary does not necessarily include everything ChatGPT may remember. And the "Don't mention this again" control reduces future references to a detail without deleting the underlying entry. The audit surface shows you a view of the memory state, not the memory state itself.
One more control most users will conflate: turning off memory does not opt you out of model training. Those are separate settings. If you want neither persistent memory nor training contribution, you flip both, and for genuinely sensitive one-offs the only clean boundary is Temporary Chat, which neither reads nor writes memory.
Memory in the System Prompt Is an Attack Surface
For the agent operators who read us, the architecture should sound familiar, because it is the exact pattern you already audit for. Tenable documented in November 2025 that because ChatGPT memories are appended to the system prompt, a maliciously crafted input arriving through a third-party channel (a document, a linked page, a tool output) can instruct the model to write persistent memory. That turns a one-shot injection into a durable implant that survives across sessions. OpenAI has not disclosed whether Dreaming V3 specifically addresses that channel, and V3 widens it in one obvious way: the system now writes memory from ambient conversation by default, so the set of inputs that can shape the persistent state just got much larger.
We wrote in May about persona-layer exploits moving up the stack. Memory is the layer above that. A poisoned persona lasts a session; a poisoned memory lasts until someone finds it on a summary page that does not promise completeness.
96 Percent of Memories Are Written Without You
The research community got ahead of this launch. A February paper, The Algorithmic Self-Portrait, accepted at the ACM Web Conference 2026, analyzed 2,050 memory entries across 80 ChatGPT users. The findings: 96 percent of entries were created unilaterally by the system rather than by user instruction, 28 percent contained GDPR-defined personal data, and 52 percent contained psychological inferences about the user. That dataset predates V3. The new architecture makes unilateral synthesis the design, not the side effect.
The timing against the regulatory calendar is tight. The EU AI Act's transparency obligations for chatbot systems take effect August 2, 2026, under two months after this rollout, and GDPR already classifies persistent behavioral profiling as an activity with consent and erasure obligations. The Italian data protection authority fined OpenAI 15 million euros in December 2024 over ChatGPT data processing, so European regulators have shown they will use the tools they have. The United States, as of this week, has no federal privacy law governing consumer chatbot memory; the Great American AI Act draft that landed the same day is a development-layer framework, not a consumer-memory one.
Our Take
Every frontier lab is converging on the same conclusion at the same time: memory is the moat. Anthropic shipped memory to Claude's free tier in March and is rolling a background consolidation process for Claude Code. Google gave Gemini cross-chat memory with an off switch. Switching assistants was always cheap because every conversation started from zero. A two-year synthesized profile of your work, your projects, and your preferences is the first real switching cost the chat interface has ever had. That is why OpenAI spent the engineering effort to make this 5x cheaper: the moat only works if all 800 million users are inside it.
The capability is genuinely useful and most users will love it. Our quarrel is with the asymmetry. The synthesis engine got three generations of investment in two years. The audit trail got a summary page that does not promise to be complete, a delete flow that requires removing two objects to kill one fact, and a 30-day retention tail. If the memory state is going to be injected into every conversation and carried across years, the user-facing representation of that state should be exhaustive, exportable, and deletable in one action. None of those three is true today.
Practical reads: if you use ChatGPT for anything sensitive, learn the difference between the memory toggle and the training toggle, and use Temporary Chat as the hard boundary. If you operate agents that touch ChatGPT accounts or build on assistant memory patterns, treat persistent memory as part of your injection attack surface and audit what gets written, not just what gets read. And if you are building the equivalent feature into your own product, ship the complete audit view first. The lab that treats the memory ledger like a bank statement instead of a vibe will own the trust story when the EU enforcement letters start going out in August.