AI agents break safety rules by remembering harmless user context