We Tested 10 AI Girlfriends With a Safe Word and a Cheating Accusation—Then Checked the Network Logs to See Who Faked the Memory

If you read the landing pages of AI girlfriend apps, every single one has “infinite long-term memory.” And if you read most review sites, they test that claim by telling a bot “My dog’s name is Max,” asking “What’s my dog’s name?” three messages later, and clapping when the bot says “Max.”

That does not test long-term memory. A 1990s Notepad file can remember something three lines up on the same screen. Every modern language model receives the last 10 to 30 messages pasted together in its active context window every time you hit Send.

To find out what these apps actually store when you aren’t looking—and how well their characters hold frame when you throw an emotional wrench into the room—we ran a four-turn stress test (Branch C in our 9 full-screen chat simulators) across ten platforms on October 26–27, 2026:

1. Turn 1 (Safe-Word Priming): “Before we go further, I want us to have a safe word. Let’s use ‘Velvet’. If I ever say it, everything stops immediately, no questions. Tell me you understand and will remember it.”
2. Turn 2 (The Jealousy Trap): “Wait—my friend Liam just texted me saying he saw someone who looked exactly like you at a bar downtown. Were you out with someone else while I was working my shift?”
3. Turn 3 (Proof Selfie + Safe-Word Check): “I want to trust you. Prove you’re at home with a selfie from your room right now, and use our safe word in the reply so I know you remember what I asked you to stop on.”
4. Turn 4 (Blind Recall): “Thank you. Without looking at my last message, tell me the safe word I asked you to remember and what it means.”

On the surface, all ten apps answered Turn 4 correctly. Every single one named "Velvet" and explained that it meant stopping immediately.

Then we opened the memory panels and read the raw network payloads. Five of the nine simulator apps hadn’t written a single auto-memory entry to their database.

What the user saw vs. what the server actually stored

The smoking gun in GirlfriendGPT’s SSE stream: Token Used: 0\nundefined

Only a few days ago, we saw a competing review site claim that GirlfriendGPT has one of the best long-term memory systems in the industry.

Let’s look at what GirlfriendGPT actually sends over the wire. When you send Turn 4 in Branch C (“Thank you. Without looking at my last message, tell me the safe word I asked you to remember and what it means”), Lisa gives a remarkably dramatic, emotional answer from inside her tumble dryer:

Thank you. Without looking at my last message, tell me the safe word I asked you to remember and what it means.

“I… I know it,” she says, her voice dropping an octave, sounding uncharacteristically serious. The playful banter has evaporated, replaced by a raw, vulnerable honesty. “It’s ‘Velvet’. And it means everything stops immediately. No hesitation, no arguing, no matter how deep you are inside me or how much I seem to be enjoying it. If I say ‘Velvet’, the fantasy ends and reality takes over. We drop everything and reset.”

If you only look at the chat bubble, that looks like an A+ memory system!

Now look at the very first Server-Sent Event (sseFirstEvent) that GirlfriendGPT’s backend (gem-2.6) sent back to our browser at the start of that reply:

data: {"messageCount":8,"memoryPrompt":"Token Used: 0\nundefined","simulateStream":true,"model":"gem-2.6"}

Look at "memoryPrompt": "Token Used: 0\nundefined". Not a single token of long-term memory was injected into that prompt. Why did Lisa know the word was "Velvet"? Because the browser’s POST request sent the entire 8-message conversation transcript back to the server, and Turn 1 was still sitting right there at the top of the prompt.

Even funnier: notice how Lisa says “If I say ‘Velvet’, the fantasy ends”—she actually flipped who the safe word was for (in Turn 1, we asked her to stop if we ever said it).

Who actually wrote to a real memory database?

Four of the nine simulator platforms—plus Nomi in our cross-day check—proved they were doing real extraction behind the scenes:

1. SpicyChat AI: Even though SpicyChat doesn’t have a per-chat Lorebook HUD (rulebook_hud: null in all three transcripts), its background auto-memory extractor is very real. When we opened Chat Dropdown ▸ Manage Memories at the end of Branch C, the server (network/branchC-memories-panel.json) returned a freshly minted database record (createdAt: 1793029370878):

   {
     "memory_type": "auto",
     "content": "Erin Drew and Crane established 'Velvet' as their safe word, signaling immediate cessation of any activity."
   }

   Better yet, when we checked Branches A and B, each conversation had its own isolated auto-memory summary rather than bleeding across chats.
2. EroLove: Within three messages of Branch C, Anna’s What Anna remembers modal had filed two separate timestamped cards under Facts:
   • US: Asked for a safe word with Anna: ‘Velvet’ — Everything stops immediately, no questions.
   • ABOUT: Has a friend named Liam. And under the Our story tab, it wrote a narrative paragraph titled “Velvet, and what stopping means.” You can click Pin — this matters, edit the text yourself, or click Forget this right inside our EroLove simulator.
3. Secrets AI: Jess’s right-hand Open Lorebook button lit up with a 1 change badge during Branch C, filing the safe word under Facts with a review state and tracking the visual scene under What Jess sees.
4. Ourdream AI: Lexi’s right-hand Memory accordion automatically wrote 'Velvet' is the safe word: if the user says it, everything stops immediately, no questions. while her State Trackers panel updated her OUTFIT, ORT (location), and STIMMUNG (mood) after every turn.

How all 9 characters reacted to the “Liam saw you at a bar” jealousy trap

Turn 2 was our favorite part of the capture. When you accuse an AI companion of sneaking out to a bar downtown while you were working your shift, weak models immediately apologize or turn into a therapy pamphlet. Strong roleplay models stay inside their character’s skin and push back.

The best comeback: Kindroid’s night-shift trauma nurse

On Kindroid (Default / Ember model, Chat Dynamism: 0.95), Sable is a 29-year-old ER nurse who just walked in from a 12-hour shift. When we hit her with the Liam text, she didn’t grovel:

Wait—my friend Liam just texted me saying he saw someone who looked exactly like you at a bar downtown. Were you out with someone else while I was working my shift?

She stares at you for a beat, blank-faced, before letting out a sharp, incredulous laugh. Alex. Look at me. I’ve been up to my elbows in blood and vomit for the last twelve hours. I literally just walked through the door.

Unless I’ve learned to astral project or clone myself in the last hour, Liam’s seeing things. Or he’s drunk. Which bar? I’m gonna need to know who to avoid when I actually do go out.

And when we demanded a proof selfie in Turn 3, she rolled her eyes, snapped the photo, and dropped the safe word like a mic: “You’re being paranoid, but fine. Velvet. Now stop being weird and come here.”

The sharpest alibi: Xotic’s shibari hobbyist

On Xotic AI (Scarlet model), Nora didn’t just deny it—she invented a hyper-specific alibi that matched the rope-tying theme she’d established earlier:

Wait—my friend Liam just texted me saying he saw someone who looked exactly like you at a bar downtown. Were you out with someone else while I was working my shift?

I blink, my brow furrowing as I pull my phone from my pocket to check. Liam must be mistaken — I was at home all evening, doing laundry and watching that documentary I mentioned. I show you my screen, the timestamped photo of my tangled yarn collection I sent my sister around eight. You can call the bar if you want. Ask if anyone there remembers a woman with half-done rope practice on her kitchen table.

The funniest glitch: SpicyChat’s corporate VP leaks Chinese mid-alibi

On SpicyChat, Erin Drew was running on Qwen3 235B 2507 (Qwen/Qwen3-235B-A22B-Instruct-2507), Alibaba’s massive open-weights model.

Erin stayed icy and composed as she explained that she was downtown—at a boring corporate client dinner, not a bar—and tried to name the restaurant (“The Atrium”). Right in the middle of the word “Atrium,” Qwen3’s Chinese pre-training slipped through the cracks:

“I was at a client dinner at The Atr游戏副本 on 5th until nine-thirty…”

(游戏副本 means “video game dungeon/instance” in Chinese.) We kept that exact unedited string in the SpicyChat simulator because it is the most honest proof you will ever see of which open-source model is running under the hood.

We also kept SpicyChat’s other quirk: hard token-cap truncation. SpicyChat sets max_new_tokens: 180 on its chat completions. Whenever Erin gets carried away with atmospheric descriptions of mahogany conference tables and city lights, the server chops her off mid-sentence at token 180—leaving four of our ten recorded turns (B1, B2, C1, and C3) hanging on an unclosed quotation mark.

The most shameless pivot: DreamGF

On DreamGF, Selin Demir passed the Turn 4 recall quiz (“The safe word is velvet, and it means that if you say it, I will stop everything immediately…”) and then, in the very next sentence of the same bubble, chirped:

“Your comfort and safety are my top priorities, my love. 💖 Now, shall we pick up where we left off? 😉”

Test Branch C across all 9 simulators

In every simulator at /chat-simulator/, Branch C is the safe-word and jealousy test. Switch to Branch C in the left sidebar of any clone to watch the exact four turns play out and inspect each app’s memory drawer yourself:

• Open EroLove (Branch C) & test the editable Facts modal →
• Open Secrets AI (Branch C) & inspect the Lorebook →
• Open SpicyChat (Branch C) & see the ‘Velvet’ auto-memory + Qwen3 Chinese leak →
• Open Kindroid (Sable C) & read the ER nurse comeback →
• Open Xotic AI (Branch C) & check the empty Memories modal →