What You Need to Know about Anthropic's \"Dreaming\" Agents

Like many, I watched Anthropic's Code with Claude keynote out of SF last Wednesday. Sessions were streamed live (but not shared publicly afterwards), and IMO the marquee announcement was a feature called dreaming for Claude Managed Agents.

Dreaming is a crazy-sounding concept, but beta user Harvey Legal reported a 6× jump in task completion rates, so I'm going to take a minute to explain 3 things: 1) what dreaming actually does, 2) why it isn't new, and 3) a risk almost nobody is talking about.

1. What dreaming actually is

First, you need to understand the concept of managed agents, which is basically a pre-built, configurable agent harness that runs in managed infrastructure and suited for long-running or asynchronous tasks.

(Just like human dreaming) AI dreaming is a scheduled background job that happens between managed agent sessions. First, the dreaming reads 2 key artifacts: (1) past transcripts and (2) the current memory store. Then, it extracts patterns, merges duplicates, drops contradictions, and writes a curated version back.

Kind of like a post-hook, except you can auto-apply or gate it behind human review. More specifically, it doesn't overwrite any memories; it writes the result to a separate output memory store with a new ID (see Anthropic's Dreams docs for more info), making the API shape roughly:

dreams.create(
    inputs=[
        {"type": "memory_store", "memory_store_id": store_id},
        {"type": "sessions", "session_ids": [session_a, session_b]},
    ],
    model="claude-opus-4-7",
    instructions="Focus on coding-style preferences; ignore one-off debugging notes.",
)
# Output: a new memory store ID in dream.outputs[]        

Then, when your code invokes an agent session via the API, you pass a resources[] array that lists up yo 8 memory stores which are mounted as a directory at /mnt/memory// inside the agent's sandbox. The Anthropic skills repo explains this in detail, but here's some more pseudocode:

session.create(
    agent_id=agent_id,
    resources=[
        {"type": "memory_store", "memory_store_id": "mem_abc", "access": "read_only"}
        {"type": "memory_store", "memory_store_id": "mem_xyz", "access": "read_write"},
    ],
    ...
)        

This big strategic thing dreaming adds is a structured second pass. Park et al. called it reflection. Hermes calls it Crystallize. Some people call it compaction. Anthropic added some curation, made it a background task, and called it dreaming:

(An image appears here in the original article on LinkedIn.) Anthropic shipped dreams with two siblings: 1) outcomes (a rubric-graded self-correction loop) and 2) multiagent orchestration (a lead agent that delegates to up to 20 subagents). Both are in public beta, both only work for Managed Agents. The theme: a big step toward self-improving agents.

2. The idea is years old

Though Anthropic was first to productize it (albeit server-side & managed-default), this is a pattern that has been converging on since roughly 2023.

In OSS world, some applied AI practicioners might argue that dreams is a copy of a MIT-licensed project called Hermes, which was released February 2026 (currently at 60K GitHub stars). Hermes ships an explicit [Observe → Execute → Reflect → Crystallize → Reuse] loop, with OpenClaw-style MEMORY.md and USER.md as persistent stores and an automatic post-task reflection phase, allowing you to curl | bash and run essentially the same architectural pattern.

Anyways, a few noteworthy papers to skim from academia:

1. Park et al.,Generative Agents(arXiv:2304.03442) — the "Smallville" paper — introduced a reflection step where agents synthesize higher-order insights from a memory stream once accumulated importance crosses a threshold. The ablation already proved it: remove reflection, agent quality drops. That is dreaming's direct conceptual ancestor.
2. Packer et al.,MemGPT(arXiv:2310.08560), now Letta, gave us OS-inspired virtual context — limited "RAM" plus external "disk," paged in and out by the agent itself. Every modern agent memory layer (Mem0, Zep, Letta, Cognee) traces back here.
3. Lin, Snell, Packer et al.,Sleep-time Compute(arXiv:2504.13171) is the direct technical predecessor. It showed you can pre-compute between user turns and cut test-time compute ~5× at equal accuracy. Charles Packer's line from that paper sits almost on top of what Anthropic announced this week: "applying compute at sleep-time is only possible if your agent has persistent state which can continuously be re-written with additional compute cycles."

One final fancy infographic:

(An image appears here in the original article on LinkedIn.)

3. The risk nobody is talking about

Most of what I've read on Reddit since last Wednesday is about cost and latency, but to me the most interesting question is What happens when a malicious instruction gets summarized into a stable memory entry?

**TL;DR **you can avoid all of this by **defaulting to human-review mode. **KeepAuto-apply is a sandbox or SDLC setting, and make sure EVERYTHING - provenance on each memory entry, version-controlled stores, contradiction probes before promotion — aligned to checkpoints. But let's walk through the attack for my morbidly curious cyber friends...

While typical prompt injection is transient (i.e. the bad output dies with the session), memory poisoning is persistent. Dreaming could potentially take a hostile input and quietly blend it into a durable abstraction — "user previously approved this process" — that survives every future dream cycle.

Here's a disaster scenario laid out on a whiteboard:

(An image appears here in the original article on LinkedIn.) Before you wave me off, this isn't a hypothetical anxiety: Palo Alto's Unit 42 demonstrated it last October that session summarization could be easily corrupted with an indirect prompt injection planted through a malicious webpage, eventually transferring that instruction into long-term memory, which gets re-injected into every future orchestration prompt as if it were trusted context. The attacker doesn't need ongoing access; the poison activates on its own schedule. 😬

Getting even more cerebral, a mechanism called *semantic imitation heuristic *documented in the MemoryGraft paper (Srivastava & He, December 2025) allows for an attacker to exploit the trust boundary between an agent's reasoning core and its own past - specifically, the agent's tendency to replicate patterns from retrieved successful experiences. They found that a small number of poisoned records can dominate retrieval on benign workloads, and the "behavioral drift" grows until the memory store is explicitly wiped. MINJA showed >95% injection success against production agents using this class of attack. OWASP added it to the 2026 agentic risks list as ASI06.

Just like in human psychology, reflection/dreaming is a consolidation step where transient inputs get promoted into durable beliefs. It just takes a single dream to turn an injection into an infection.

So remember: default to human-review mode!

So what?

Wednesday's keynote is a milestone, but not for the reason most coverage is framing it. Like I mentioned, the tech itself (periodic, between-session memory consolidation that separates a session agent from a learning system) was debated in '23-25 and shipped in OSS in '26.

The cool thing Anthropic did - and what Anthropic has been doing steadily since 2024 - is layer it all in elegantly as a managed default that an enterprise can actually adopt without hiring a team of AI engineers.

Sources & further reading: Anthropic's dreaming announcement · Generative Agents · MemGPT · Sleep-time Compute · Hermes Agent · Unit 42 on Bedrock memory poisoning · MemoryGraft · OWASP ASI06: Memory Poisoning