Hugging Face ships funes, a portable memory for 4 coding agents

Hugging Face has released funes, a durable memory layer that indexes the coding agent sessions already sitting on your machine. It supports Claude Code, Codex, pi and Hermes, and one command wires it into any of them.

funes ships as a single binary, and the announcement says its default inference backend has no ML runtime dependency. Embedding and reranking happen locally. The add command builds the first index, gives the agent recall and get tools, and installs a hook that indexes each completed turn. Indexing is incremental, so new runs add new turns rather than embedding the whole history again.

Underneath that sits one deterministic pipeline. Every supported trace is parsed into the same turn and block shape, chunked, embedded with a pinned local model, then written to a local Lance dataset. A query fuses vector and BM25 search, reranks the candidates with a cross encoder, reweights them by recency and attaches neighboring chunks. If you have read our walkthrough of how coding agents actually work, this is that retrieval stage pointed at the agent’s own past.

The design bet is in what comes back. Recall returns the original text rather than a summary, and it names the agent, timestamp, session and turn that produced it. So Hugging Face measured it against the two usual answers to a bloated session, compaction and a written handoff, on what it calls the handoff versus recall benchmark. Compaction was the only one of the three whose result divided, arriving on one task and never arriving on the other.

Recall was the cheapest channel on both tasks, 8x cheaper than a written handoff on one and 4x on the other. That’s the whole argument for storing passages instead of summaries, which means a finding doesn’t have to survive being compressed.

Sharing a memory, and the part that can leak

But a memory gets more useful once it leaves one machine. Bind one and the local Lance dataset gets published to a Hugging Face dataset repo you own, private by default, then kept current at session boundaries. Remote recall caches the dataset files locally, so warm queries come back at local speed. The project repository lists prebuilt binaries for three platforms: Linux x86_64, Linux aarch64 and macOS Apple Silicon.

Session transcripts are sensitive, so the security policy is blunt about it. Credentials are redacted at index time, and an always on gate scans every outgoing chunk with trufflehog, withholding any row that still contains a secret. The gate is fail closed, so nothing publishes if the scanner is missing or crashes. It also flags that a memory published by somebody else is untrusted input, because a malicious one could carry instructions aimed at your agent.

Two papers from the same week say memory is the risk

Persistent memory supports personalized agents, but a stale stored fact can override current authoritative evidence without warning.

Jundong Hu and Shekar Ramachandran, via arXiv

Their paper, submitted on 1 September 2026, scores a frozen closed set benchmark across the Qwen3 0.6B to 8B series, so the trend is a like for like comparison. In its Benefit suite, models answered with the stale value 0.92 to 1.00 of the time at every scale. In the Safety suite, where an authoritative tool always holds the correct value, harm is capability gated, and the larger models collapse most once a stale note is made to look current. Removing a label amplified over trust at every size.

And a second paper, submitted three days later, asks whether a memory survives a model upgrade at all. Ankit Goyal and Jaideep Ray compare four ways of holding history across 48 synthetic histories and two open weight models below 10 billion parameters.

Memory format	Accuracy after a writer model swap
Fixed schema knowledge graph	+0.0004 ± 0.0020
Model compressed notes	+9.91 or -13.28 points, by direction
RAG on a 50/50 mixed index	4.96 points of an available 11.90

Store only repair of the compressed notes missed a 90% recovery target in all 48 cases, because the loss happened when the notes were written. Keeping the raw source history let repair succeed in 34 of 48 for one tested direction. That’s an independent case for funes handing back passages rather than summaries.

None of this is settled. The trust gap results come from Qwen3 and Llama Instruct checkpoints, not the frontier models most people point a coding agent at, and the funes cost figures cover two tasks. The thing worth watching is whether an agent recalling months of its own reasoning starts preferring a stale decision over the file in front of it. Our piece on long context versus retrieval covers the other half of that tradeoff.