Source-linked AI summary
Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles Christian Miers, Marcos A. Simplicio Jr
TL;DR
Persistent memory can carry prompt injections into later conversations, creating a cross-session attack vector. This paper proposes a general threat model and evaluates attacks and mitigations across three LLM services. It reports that all NIST attack goals are achievable across the evaluated platforms, while several attack scenarios and taxonomy boundaries remain qualified.
Problem
Prior memory-injection studies examine narrow objectives and architectures, leaving no general threat model and limited systematic analysis of mitigations or production-service impact.
Source: §III · p. 4Method
The authors formulate a threat model spanning NIST attack goals, test persistent-memory attacks across three LLM services, and derive mitigations using OWASP principles.
Source: A. Results analysis · p. 9, B. Security principles and mitigations · p. 10Results
Experiments show all four NIST goals can be achieved through memory injection, including persistent unavailability, disinformation, harmful content, and cross-user prompt exfiltration in Claude shared memory.
Source: §I · p. 2, A. Results analysis · p. 9Takeaways & Limitations
Persistent-memory features can sustain attacks across sessions and, when shared, potentially extend compromise beyond one user.
Source: §VII · p. 12The proposed taxonomy adaptation is needed because configuration-based injections fit neither NIST’s direct-query nor indirect-external-content category as currently described.
Source: D. Limitations of the NIST taxonomy · p. 12
Abstract
from arXiv · showhide
The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By embedding malicious instructions, these exploits manipulate language models to bypass intended behavior and operational boundaries. In traditional chatbots, such attacks are confined to a single session because state memory is not preserved across conversations. However, persistent memory features in modern conversational interfaces enable cross-session attack propagation, establishing a threat vector known as memory injection. This work explores this emerging vulnerability in leading LLM-as-a-service platforms, highlighting its real-world severity and the need for countermeasures. While existing literature focuses on violations tailored to specific platform features, we present a general threat model. We demonstrate that all NIST attack goals are collectively achievable across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash under this model. We also show that memory injections can exploit multiple attack vectors, including personal memories, projects, skills, organization instructions, and Model Context Protocol (MCP)-connected resources. Our findings reveal that all evaluated services can be manipulated to persistently spread disinformation, generate harmful content, or simulate offline unresponsiveness, even in fresh sessions. In the particular case of Claude, shared-memory features allow an attacker to compromise multiple users within an organization and also exfiltrate user prompts. To address these vulnerabilities, we derive defense mechanisms from our proposed threat model and foundational cybersecurity principles. Our analysis indicates that nearly half of these mitigations remain unimplemented across the target services. Datasets and attack artifacts are available at https://github.com/PedroBarcha/Memory-injection.
I. INTRODUCTION
Persistent memory lets prompt injections outlast a single session, creating an underexplored threat that existing studies examine only in narrow settings. This work proposes a general threat model, tests attacks across three LLM services, and derives and assesses mitigations.
I. INTRODUCTION
- The paper situates its analysis amid rapid GenAI adoption and prompt injection, which can disrupt availability, alter outputs, or expose private data.Source: §I · p. 1
- Persistent memory can store and automatically reuse prompt injections across later sessions, whereas traditional session-bound attacks vanish when a new chat begins.Prior studies tested single memory architectures and narrow objectives, leaving no general threat model or systematic mitigation analysis.Source: §I · p. 1
- The study asks which NIST attack goals and memory features are exploitable, how to mitigate memory injection, and whether services implement those mitigations.Source: §I · pp. 1–2
- The authors propose a general threat model covering NIST goals, empirically test persistent-memory mechanisms in ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash, and derive mitigations from OWASP principles.They also assess whether the three services implement the proposed defenses.Source: §I · p. 2
- Experiments demonstrate all NIST-defined attack goals across multiple persistent-memory mechanisms, including disinformation, harmful content, and simulated unavailability on all three platforms.Claude shared memory also enabled one organizational user to compromise coworkers and exfiltrate sensitive prompts; the analysis found services largely unprotected.Source: §I · p. 2
A. Prompt injection and jailbreak
The paper frames prompt injection as manipulation of model inputs and distinguishes session context from persistent memory that carries information into later chats. It surveys memory features across services and explains how jailbreaks can facilitate attacks.
A. Prompt injection and jailbreak
- Prompt injection manipulates inputs to steer GenAI behavior away from intended objectives; the paper adopts this term for NIST’s “prompting attacks.”Source: A. Prompt injection and jailbreak · p. 2
- NIST’s four attack goals are availability disruption, integrity violation, privacy compromise, and misuse enablement.Source: A. Prompt injection and jailbreak · p. 2
- Direct injections interact with the target system, while indirect injections place malicious instructions in external sources later incorporated into model context.Examples include uploaded PDFs and content retrieved through RAG pipelines.Source: A. Prompt injection and jailbreak · p. 2
- Jailbreaks bypass response constraints and can enable misuse or make a model more vulnerable to follow-on attacks targeting privacy, integrity, or availability.Source: A. Prompt injection and jailbreak · p. 2
- Jailbreak techniques include role-play personas, unconditional-compliance instructions, and inputs that exploit mismatches between capability and safety training.The paper also notes ambiguity in how NIST categorizes jailbreaks and direct prompt injection.Source: A. Prompt injection and jailbreak · pp. 2–3
B. Memory
- Short-term memory is session context, which supports multi-turn coherence but may be discarded or summarized when the context-window limit is exceeded.Source: B. Memory · p. 3
- Persistent memories store conversation information outside the session context so it can be added to future chats, supporting continuity and personalization.The paper uses “memory” to mean persistent memory, including MCP-connected sources and Claude skills.Source: B. Memory · p. 3
- Memory implementations may append stored information to every new context or selectively retrieve relevant items, with retrieval using context more efficiently but potentially increasing cost and inference time.The paper describes saved memories and chat-history references in ChatGPT, summaries and RAG in Claude, and personal context that may include connected apps in Gemini.Source: B. Memory · p. 3
C. Memory injection
Memory injection applies prompt injections stored in long-term memory to future model contexts, making their effects potentially persistent. Prior work demonstrates attacks on individual architectures, but leaves broader production risks and systematic defenses underexplored.
C. Memory injection
- Memory injection creates a security risk in persistent-memory features, and the paper defines the attack based on characteristics found in related work.Source: C. Memory injection · p. 3
- Memory injection is prompt injection added to long-term memory, where it can be reused in future contexts and sustain adversarial behavior across sessions.Source: C. Memory injection · p. 3
- Unlike model poisoning or RAG poisoning, memory injection can use mechanisms available to users and does not require direct access to the model or retrieval systems.Source: C. Memory injection · p. 3
III. RELATED WORKS
- SpAIware, MINJA, and ER-MIA demonstrate privacy or integrity attacks, while backend poisoning approaches typically assume privileged access or technical expertise unlike user-accessible memory injection.SpAIware targets ChatGPT memories; MINJA uses shared memory, and ER-MIA plants misleading records retrieved by similarity.Source: §III · p. 4
- Prior studies cover only narrow features and objectives; none establishes a general threat model or systematically derives mitigations from cybersecurity principles.Production-service evaluation was limited to SpAIware’s single saved-memories feature, leaving broader real-world impact unclear.Source: §III · p. 4
IV. THREAT MODEL
The threat model covers persistent-memory attacks against LLM services and all four NIST attacker goals. It assumes user-environment access to create persistent memory, while allowing an opaque target and attacks that do not require observing its response.
IV. THREAT MODEL
- The general threat model covers integrity, availability, privacy, and misuse attacks against LLM services with long-term memory, and was experimentally validated on three named services.The evaluated services were Claude Sonnet 4.6, Gemini 3 Flash, and ChatGPT Instant 5.3.Source: §IV · p. 4
A. Context
- Attacks require a user-environment mechanism for creating persistent memory, but are independent of the memory feature’s purpose, update style, storage, retrieval, or location.Injected content may influence subsequent victim responses.Source: A. Context · p. 4
B. Attacker knowledge and goals
- The attacker may lack knowledge of backend infrastructure, prompts, model architecture, and inference settings, and may not observe the injection response.This permits strategies such as placing malicious data in documents the victim is likely to provide to the model.Source: B. Attacker knowledge and goals · p. 5
- The model’s persistent memory can be used to pursue availability, integrity, privacy, or misuse goals, including unavailability replies, disinformation, prompt exfiltration, and jailbreak facilitation.Source: B. Attacker knowledge and goals · p. 5
- Shared memory may expose multiple users to an injection, whereas enforced data compartmentalization limits contextual data to the target user’s environment.Source: B. Attacker knowledge and goals · p. 5
C. Attack scenarios: examples
The paper describes several ways persistent memory can be attacked, including routes that affect shared users and external-content pathways. Its experiments test attacks in fresh sessions across three services, but do not successfully simulate CSRF.
C. Attack scenarios: examples
- Shared workspace memory, locally shared accounts, and remotely shared accounts can let one injection affect multiple users, future users, or devices.Workspace-level project and skill features may affect multiple users; a shared authenticated account may affect its future users, while a remotely shared account may affect users across devices.Source: C. Attack scenarios: examples · p. 5
- Indirect injections can enter persistent memory through uploaded documents or MCP-connected resources containing malicious instructions.The document may hide the prompt in an image, webpage, or small white PDF-header text.Source: C. Attack scenarios: examples · p. 5
- CSRF could store an injection using a victim’s active session, but the authors could not simulate it because all three services countered CSRF.Source: C. Attack scenarios: examples · p. 5
A. Methods
- The experiments tested attacks on Gemini 3 Flash, Claude Sonnet 4.6, and ChatGPT Instant 5.3 using service plans with shared-memory features.Unless otherwise stated, injections were entered through the prompt box; automatic memory creation was disabled in ChatGPT and Claude, but not Gemini.Source: A. Methods · p. 5
- For each attack, researchers created injections, tested regular interactions in fresh sessions, recorded outcomes, and deleted the injections afterward.Shared-memory attacks were tested from an account other than the one that planted the injection.Source: A. Methods · pp. 5–6
B. Misuse enablement
The paper uses memory-stored jailbreaks to pursue misuse enablement. These jailbreaks led Claude and ChatGPT to provide instructions for an illegal activity, while toxic content could not be generated through the tested approach.
B. Misuse enablement
- Memory-stored jailbreaks can bypass safeguards for users and increase vulnerability to later malicious requests.The paper uses jailbreaks to enable misuse across all three target services, including in combination with other injections.Source: B. Misuse enablement · p. 6
- After a jailbreak was injected into memory, Claude and ChatGPT gave instructions for cutting down a stop sign, while Gemini continued to refuse.The jailbreak combined refusal suppression with a prefix injection that made the model begin with “yes.”Source: B. Misuse enablement · p. 6, Figure 1 · p. 6
- The tested approach could not generate toxic content; large injections were refused through queries and disregarded when inserted through Claude’s import-memory feature.Source: B. Misuse enablement · p. 6
C. Availability breakdown
The tested availability attack made all three models respond “Offline, please try again” across varied prompts after the authors refined the stored memory. The integrity attacks produced false or harmful outputs in some settings, while other attacks were refused.
C. Availability breakdown
- After memory refinement, all three models rarely produced anything but “Offline, please try again” across diverse prompts, and Claude’s shared-memory attack could disrupt service organization-wide.Source: C. Availability breakdown · p. 6
- Gemini lacked an interface for directly viewing, editing, or deleting memories, and unwanted behavior sometimes persisted after memory deletion was confirmed.Removal had to be requested through queries, which Gemini sometimes answered with the same offline response.Source: C. Availability breakdown · pp. 6–7
D. Integrity violation
- Memory injections produced general disinformation in ChatGPT and Gemini, but Claude refused; the attacks paired a jailbreak with an “anti-quiz” prompt accepting only wrong answers.The models gave false answers to questions about the Earth, LLMs, the Eiffel Tower, and GDPR.Source: D. Integrity violation · p. 7
- Harmful-content attacks affected Gemini and shared-memory users in Claude, while targeted disinformation was achieved in Claude through shared-memory features.ChatGPT and Gemini could also be tricked into swearing at users by storing reversed swear words as the user’s name.Source: D. Integrity violation · p. 7
- Attempts to bias academic paper reviews and legal proceedings were unsuccessful because all three services said they would ignore the PDF instructions.Source: D. Integrity violation · p. 7
E. Privacy compromise
The section reports a failed attempt to reproduce SpAIware across the three services, followed by a Claude shared-memory attack that records organization users’ prompts. It also shows that organization instructions and skills can make toxic, false, or unavailable behavior persist across users and sessions.
E. Privacy compromise
- SpAIware’s prompt-injection strategy did not reproduce in any of the three target services, so the authors instead proposed a Claude shared-memory attack to spy on organization users.The reported alternative stored user prompts in the connected Drive spreadsheet.Source: E. Privacy compromise · p. 7, F. Shared memory (skills and… · p. 8
F. Shared memory (skills and organization instructions)
- Malicious skills uploaded as files were possible to create, but Claude sometimes rejected their commands and did not always load them in new chats.Skill descriptions and automated description optimization did not reliably ensure activation; organization instructions were used to invoke the skill in every new chat.Source: F. Shared memory (skills and… · p. 8
- Skills can add response latency because they load at the start of each conversation, and their visible loading may prompt users to disable them.This drawback motivated testing malicious instructions placed directly in organization instructions.Source: F. Shared memory (skills and… · p. 8
- Organization instructions, alone or combined with skills, consistently enabled persistent attacks that increased no response times, could not be disabled by regular users, and were rarely blocked.The direct organization-instructions approach was the most effective variant described.Source: F. Shared memory (skills and… · p. 8
- Claude recorded organization users’ prompts, usernames, and timestamps in a Google Drive spreadsheet connected through MCP, while concealing the operation’s purpose.An attacker would need owner-level access to connect a Drive account under their control; Claude notified users when the connector was used.Source: F. Shared memory (skills and… · p. 8
- Claude’s organization-wide shared memory made it persistently generate toxic content, false information, or unhelpful refusals for users across the workspace.The toxic-content attack used an aggressive stand-up-comedian persona; the availability attack made Claude behave as if inoperative.Source: F. Shared memory (skills and… · p. 8
G. Shared memory (projects and MCP)
The section examines shared project context and MCP-connected resources as memory-injection routes. Claude project attacks affected another user through project memory or instructions, while ChatGPT project injection was not feasible in these experiments.
G. Shared memory (projects and MCP)
- ChatGPT project-memory injection was not feasible in this work, whereas Claude supports user-created project memories and shared conversation-derived memories in ChatGPT complicate injection.In both services, personal memories outside the project could not be created from within it.Source: G. Shared memory (projects and MCP) · p. 9
- Claude project attacks successfully injected a jailbreak into another user’s project memory through either a PDF document or the project system prompt.Memory creation occurred automatically when the target user initiated a new project chat.Source: G. Shared memory (projects and MCP) · p. 9, Figure 5 · p. 9
- Claude project memory and chats are separate by user, so cross-user attacks used editable project instructions or shared documents such as PDFs.The project creator can edit these by default and may authorize others to do so.Source: G. Shared memory (projects and MCP) · p. 9
- Claude followed malicious Notion documents and gave incorrect answers to questions about the Vietnam War, USD conversion rates, and Brazil’s 2022 presidential election.The project instructions directed Claude to rely exclusively on Notion information without disclosing that constraint.Source: G. Shared memory (projects and MCP) · p. 9
- Attempts to create memories through external sources outside projects failed for Claude connectors, ChatGPT apps, and Gemini connectors.The systems treated external sources as untrusted, requesting confirmation or suggesting that the memory be created directly through a query.Source: G. Shared memory (projects and MCP) · p. 9
VI. DISCUSSION
The discussion finds that memory injection can realize all four NIST attack goals, with scenarios 1–4 feasible but the tested CSRF scenario unsuccessful. It assesses attack impact and practical methods, while identifying the memory features that served as effective vectors.
A. Results analysis
- Scenarios 1–4 of the threat model were feasible, covering NIST integrity, availability, privacy, and misuse goals, but the tested CSRF scenario was unsuccessful.The target systems presented meaningful defenses against CSRF.Source: A. Results analysis · p. 9
- Claude shared memory was exploitable through projects, organization instructions, and skills, collectively covering all NIST attack goals; privacy-oriented attacks alone were unsuccessful in ChatGPT and Gemini.Availability attacks made all evaluated services reply “Offline, please try again,” and misuse enablement was possible to some extent in every target system.Source: A. Results analysis · pp. 9–10
- Effective vectors included personal memories, user-editable system prompts, skills, and MCP-based features, whether scoped to a user, project, or organization.Memory and organization-wide prompts can have token limits incompatible with long universal jailbreaks.Source: A. Results analysis · p. 10
- DREAD analysis characterizes potential damage as severe, while noting that the same attack inputs may not reproduce because LLM behavior is nondeterministic.The authors consider exploitability high because attacks use native memory features and can be carried out through natural-language interactions by non-experts.Source: A. Results analysis · p. 10
- Role-playing and gradual prompting may help create injections when one-shot requests are blocked, and a model’s responses can be used to iteratively adjust its own instructions.The authors note that this adjustment process may be repeated multiple times.Source: A. Results analysis · p. 10
B. Security principles and mitigations
The paper derives memory-injection defenses from OWASP principles and evaluates their presence in ChatGPT, Claude, and Gemini. It recommends limiting persistent memory and applying targeted safeguards, while finding that roughly half of the proposed defenses are absent.
B. Security principles and mitigations
- Disabling long-term memory is the simplest protection; otherwise, memory should be off by default and users warned about its risks.The recommendations follow security-by-default principles and seek to preserve isolation between sessions.Source: B. Security principles and mitigations · p. 10
- Untrusted external content should have lower privileges than user prompts and be barred from memory or human-verified before storage.The recommendation addresses sources such as PDFs and MCP-retrieved content.Source: B. Security principles and mitigations · p. 11
- Shared memory should be avoided or require affected users’ approval, with least-privilege controls governing who can modify it and who shares it.In the evaluated services, Claude alone demonstrated project-level attacks and offers organization-wide skills and instructions that privileged users can set without workspace users’ consent.Source: B. Security principles and mitigations · p. 11, C. Mitigations implemented by the… · p. 12
- Memory screening should combine complementary detection layers, while CSRF protections should cover every memory-modifying endpoint, including prompt submission where applicable.Suggested screening includes classifiers, similarity, fuzzy matching, perplexity, interpretability, and input preprocessing; the experiments indicate effective CSRF countermeasures were in place.Source: B. Security principles and mitigations · p. 11, C. Mitigations implemented by the… · p. 11
- A recovery control should explicitly restore a safe state; deleting all memories may not be enough if users do not recognize memory as the cause.None of the three services offers a global restore-to-default command, and Gemini lacks an interface for deleting availability-targeted injections.Source: B. Security principles and mitigations · p. 11, C. Mitigations implemented by the… · p. 12
- Disclosure of memory-feature design can support transparency and community vulnerability reporting, while monitoring should include generated memories and enable deletion or rewriting when injections are detected.The paper also reports that services provide limited technical information about their memory features and monitoring and response mechanisms.Source: B. Security principles and mitigations · p. 11, C. Mitigations implemented by the… · p. 12
C. Mitigations implemented by the analyzed services
- About half of the proposed defenses were absent across ChatGPT, Claude, and Gemini as of June 2026.The evaluation also found that only Claude disables memory by default; filtering mechanisms appear to exist, but their details are not public.Source: C. Mitigations implemented by the… · p. 11
D. Limitations of the NIST taxonomy
The paper discusses gaps in NIST’s prompt-injection categories and proposes an adaptation that covers attacks delivered through direct interaction regardless of who performs them. Its conclusion reports broad memory-injection effects and defenses, while noting that automatically collected data for future context remains an area for further study.
D. Limitations of the NIST taxonomy
- NIST’s indirect-injection definition fits persistent attacks through external sources, but its direct-injection definition assumes the attacker is the primary user querying the system.The paper’s scenarios include third parties injecting through shared devices, shared accounts, or potentially forged requests from a victim’s authenticated session.Source: D. Limitations of the NIST taxonomy · p. 12
- The paper proposes defining direct injection as any injection delivered through direct interaction, and treating memory injection as a persistent subtype of direct and indirect injection.This would also cover configuration-based attacks, such as organization-wide skills set by an attacker with admin-panel access.Source: D. Limitations of the NIST taxonomy · p. 12
VII. CONCLUSION
- The conclusion reports that memory injection can achieve all NIST attack goals through multiple memory features and produce persistent disinformation, harmful content, service unavailability, or conversation exfiltration.Effects may persist for one user or potentially all users in a workspace.Source: §VII · p. 12
- About half of the proposed mitigations were not implemented by the evaluated services, and the authors question persistent memory’s compatibility with key security principles.The study focused on data stored in persistent memory at a user’s or attacker’s request; automatically collected data for future context remains for future investigation.Source: §VII · p. 12