Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

Summary

Researchers show that persistent memory features in ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash enable memory injection, letting malicious instructions carry across sessions. They report that all NIST attack goals are achievable under their general threat model, including persistent disinformation, harmful content, and simulated offline unresponsiveness. On Claude, shared-memory features let an attacker compromise multiple users in an organization and exfiltrate user prompts.

Mitigation

Derived defense mechanisms from the proposed threat model and foundational cybersecurity principles; the authors state that nearly half of these mitigations remain unimplemented across the target services.

Topics

• Prompt injection and jailbreaks

Related items

• LowThird-party evaluators found vulnerabilities in OpenAI monitoring system during test pilotSame vendor · CNBC Technology
• InfoOpenAI, Anthropic, and Nvidia had record lobbying quartersSame vendor · The Verge (AI)
• MediumRed-Teaming OpenAI's Internal Agent Monitoring SystemsSame vendor · Redwood Research Blog
• Info1Password lets AI agents use your passwords without seeing themSame vendor · The Verge (AI)
• InfoClaude did not invent scorpion antivenomSame vendor · The Verge (AI)