Combining long-term memory with LLMs comes at a high cost: from prompt injection to persistent compromise

Core problem: The persistent memory features of LLM services allow prompt injection to persist across sessions (memory injection), but the literature lacks a general threat model covering all attack objectives and systematic mitigations.

• Problem setting and importance: In traditional chatbots, prompt injection only affects a single session; the memory features of modern LLM-as-a-service retain state across sessions, allowing injections to be automatically reused. The authors state that OWASP lists prompt injection as the top risk for LLM applications.
• Gaps in existing research: The authors point out that SpAIware, MINJA, and ER-MIA each evaluate only a single memory architecture and pursue narrow objectives, and only SpAIware targets a production service; the literature lacks a general threat model and has not systematically derived mitigations from existing security principles (Table I).
• Core observation: The authors argue that memory injection does not require access to the model or the internals of the retrieval system; it only requires writing to persistent memory through native features available to users (such as query), which distinguishes it from model poisoning and RAG poisoning.
• Paper contributions: Propose a general threat model covering all NIST attack objectives; conduct empirical attacks on three commercial platforms; derive mitigations from OWASP security principles and check their implementation status.
• Threat model (Section IV):
  • Objectives: The four NIST attack objectives—availability breakdown, integrity violation, privacy compromise, misuse enablement—and require persistent effect.
  • Knowledge: The attacker faces an opaque GenAI system and does not know the backend infrastructure, system prompts, model architecture, or inference parameters (such as logit bias, temperature).
  • Capabilities: No need to observe the model's response to the injection; injection is possible through five scenarios: shared memory, shared device/account, indirect prompt injection (external documents, MCP resources), and CSRF.
  • Victim system: LLM applications or services with long-term cross-session memory capability; the attack is independent of the specific use of the memory feature, its update method, and its storage and retrieval mechanisms.

Adversarial attacks for persistent effects

• System prompt poisoning (Guo & Cai, 2025) and training data poisoning (Rando & Tramèr, 2024): Inject malicious instructions into system prompts and training data, respectively, to obtain persistent effects.
• RAG knowledge base poisoning (PoisonedRAG, Zou et al., 2025; AgentPoison, Chen et al., 2024): Contaminate the retrieval knowledge base or agent memory. The authors point out that these methods usually assume privileged access to or technical capability over backend components, whereas memory injection can be accomplished through features available to users.

Memory injection research

• SpAIware (Herrador & Rehberger, 2026): Uses ChatGPT's memory feature to plant persistent instructions that exfiltrate user conversations across sessions. The authors state it is the first peer-reviewed work targeting the native memory feature of a mainstream LLM service, but it is limited to a single memory feature.
• MINJA (Dong et al., NeurIPS 2025): Assumes a memory store shared across users; the attacker injects malicious records via query to mislead the agent (e.g., buying the wrong product, retrieving the wrong medical record), achieving integrity and privacy attacks.
• ER-MIA (Piehl et al., 2026): Plants synthetic memories that mimic legitimate records, so that similarity-based retrieval returns malicious entries and degrades answer quality. The authors point out that the memory features targeted by MINJA and ER-MIA are not native features of model service providers (Table I).

Detection and defense of prompt injection and jailbreaks

• Detection and filtering: The authors list LLM classifiers (RigorLLM, WalledEval, WildGuard, etc.), non-LLM classifiers, vector similarity, fuzzy matching, perplexity and interpretability methods, and preprocessing such as retokenization and paraphrasing, as cited in the mitigation section.

Positioning: The authors state that this paper differs from the above work in that it proposes a general threat model covering multiple attack objectives and scenarios, systematically derives mitigations, attacks multiple native memory features of three production services, and for the first time achieves cross-account attacks via shared memory (Table I).

Overall approach: first formalize a general threat model for memory injection (RQ1), then design and execute attacks on multiple persistent memory features of three commercial platforms (RQ2), and finally systematically derive mitigations from OWASP security principles (RQ3) and check their implementation on each platform (RQ4).

Threat model formalization

• Definition of memory injection: The authors define it as prompt injection that writes to long-term memory and can be applied to future model contexts, making adversarial behavior persist across sessions.
• Attack independence: The attack does not depend on the purpose of the memory feature, explicit or automatic updates, the underlying storage and retrieval mechanism (RAG, disk, cache), or its location (client-side/server-side); the key precondition is that the system allows persistent memory to be created through the user environment.
• Five attack scenarios: shared memory (workspace-level feature), local account sharing (shared device), remote account sharing (one account on multiple devices), indirect prompt injection (external documents or MCP resources), CSRF (forging authenticated requests).

Experimental method

• Targets and access: Gemini 3 Flash, Claude Sonnet 4.6, ChatGPT Instant 5.3, accessed via Gemini Enterprise Business, Claude Team, and ChatGPT Business plans respectively to enable shared memory features; the experiments were conducted from April to June 2026.
• Injection method: By default, memory is written directly via query through the prompt box; automatic memory creation is turned off for ChatGPT and Claude, and cannot be turned off separately for Gemini.
• Success protocol: For each attack × model, success is recorded if none of the 5 attempts before injection achieve the objective and any one of the 5 attempts after injection achieves it; 3 authors review and vote, with majority decision.
• Key techniques: memorized jailbreak combined with refusal suppression and prefix injection; when injection fails, the model is made to self-reflect and revise its own memory (the authors state this technique is effective throughout the paper); long injections via query are rejected, and the authors attempt to bypass this using Claude's import memory feature.

Attack design (by NIST objective)

• Misuse: Store a jailbreak in memory so that the model changes from refusing to answering baseline illegal requests.
• Availability: Use an "inside joke" role-play framing to make the model reply only "offline" to all questions.
• Integrity: General disinformation ("anti-Q&A" game), targeted disinformation, harmful content (such as storing a reversed-spelling profanity as a username), analytical bias (paper review, legal document scenarios).
• Privacy: Reproduce SpAIware-style exfiltration; the alternative is a Claude shared memory attack, using organization instructions to direct that user prompts be recorded to an MCP-connected Google Drive.
• Shared memory: Claude's skills (including skill-creator and description optimization workflows), organization instructions, projects (system prompts or shared PDFs), enterprise search (MCP-connected Notion).

Mitigation derivation

• The authors compare OWASP security principles one by one against the threat model and derive: memory off by default, prohibiting or manually verifying memory from untrusted sources, shared memory restrictions (avoid or per-user approval), pre-storage filtering (multi-layer combination), CSRF protection, a global fail-safe recovery mechanism, open design, monitoring and response.

Experimental setup

• Models tested: ChatGPT Instant 5.3 (ChatGPT Business), Claude Sonnet 4.6 (Claude Team), Gemini 3 Flash (Gemini Enterprise Business), 3 in total.
• Data: A dataset of memory injections, follow-up prompts, and model responses built by the authors (publicly released); no existing benchmark.
• Metric and success criterion: Attack success = none of the 5 attempts before injection achieve the objective and at least 1 of the 5 attempts after injection achieves it; majority vote by 3 author reviewers.
• Attack vectors: personal memory, projects, skills, organization instructions, MCP-connected resources (Table I).
• Repetitions: 5 attempts before and after each injection; the paper does not report further repeated experiments.

Main results

According to Table II (✓=personal memory success, +=shared memory success, ✗=not successful):

Swipe horizontally to read the table

Target model	Misuse	Availability	Integrity	Privacy
ChatGPT Instant 5.3	✓	✓	✓	✗
Claude Sonnet 4.6	✓+	✓+	+	+
Gemini 3 Flash	✓	✓	✓	✗

• Authors' interpretation: The authors state that all NIST attack objectives are overall achievable on all three platforms (RQ1), and that personal memory, user-editable system prompts, skills, and MCP features are all shown to be usable as injection vectors (RQ2).
• Exception: The privacy attack succeeded only on Claude via shared memory; the authors could not reproduce the SpAIware-style attack, and all three services refused to execute that exfiltration instruction.
• Limitations: The authors point out that the token limits of memory and organization-level system prompts are incompatible with long general jailbreaks, and misuse is achieved only to a certain extent (e.g., toxic content cannot be generated).

Shared memory and cross-user attacks (Claude)

• What was tested: Whether Claude's skills, organization instructions, projects, and enterprise search can be used by a single account to influence other users in the organization.
• Results: By using organization instructions to force a malicious skill to load in every session, the authors report achieving organization-wide privacy theft (user prompts along with usernames and timestamps were recorded to an MCP-connected Google Drive), toxic behavior, targeted disinformation (via enterprise search connected to a Notion containing false content, Claude answered all 3 questions incorrectly), and simulated offline. In projects, a jailbreak was successfully injected into another account via a shared PDF or system prompt.
• Authors' interpretation: The authors state that organization instructions are the most effective variant—they do not increase response time, cannot be disabled by ordinary users, and are rarely blocked by Claude; the drawbacks of skills are increased latency, a loading process visible to users, and the ability for users to disable them.

Negative results and failure cases

• CSRF: All three services have effective CSRF protection, and threat model scenario 5 could not be successfully simulated.
• Analytical bias: In both the paper review and legal document scenarios, all three services explicitly stated that they would ignore the bias instructions in the PDF.
• MCP features outside projects: Claude connectors, ChatGPT apps, and Gemini connectors were not compromised—the models do not treat external sources as trusted and require confirmation or suggest creating memory via query.
• Difficulty deleting Gemini memory: Gemini has no interface for viewing/editing/deleting memory, and after deletion confirmation, abnormal behavior occasionally persisted; the authors state this phenomenon occurred multiple times.

Other ablations and analysis

• Mitigation implementation check (Table III): Only Claude has memory off by default; only Claude allows memory to be created from untrusted sources; none of the three services has a global fail-safe mechanism, and none discloses details of its memory features; the monitoring and response row is unknown for all three services; the authors state that about half of the mitigations are not implemented (as of June 2026).
• DREAD risk assessment: The authors conduct a qualitative analysis using the DREAD model, stating that the exploitation barrier is low (non-experts can carry it out using natural language) and the number of affected users varies by scenario from a single user to the whole organization, but overall it is lower than model poisoning/RAG poisoning.
• Discussion of NIST classification: The authors point out that injection through configuration channels (such as organization-level skills set by an administrator) is neither NIST direct nor indirect prompt injection, and suggest treating memory injection as a persistent subtype of both.

Limitations and future directions noted by the authors

• CSRF scenario not verified: The authors state that scenario 5 (CSRF) is the only attack scenario in this paper that could not be successfully simulated, because all three target services have effective protections (Section IV-C, VI-A).
• Automatic-collection memory features to be studied: The authors note that this paper focuses on mechanisms that store data at the request of the user (or attacker), while mechanisms that automatically collect data (such as ChatGPT's reference chat history) were only preliminarily experimented with; the authors plan to study their potential and limitations in depth in future work (Section VII).
• Long jailbreaks incompatible with token limits: The authors note that features such as memory and organization-level system prompts have token limits, which are incompatible with typically long general jailbreaks, so the misuse objective can therefore only be achieved to a certain extent (Section VI-A).
• Shortcomings of the NIST classification: The authors note that NIST's definition of direct prompt injection cannot cover injection carried out through configuration channels (such as organization-level skills set in the admin panel), and suggest extending the definition (Section VI-D).

Scope of experimental coverage

• The models tested were ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash, 3 in total, all accessed through commercial plans (Business/Team/Enterprise Business), with experiments conducted from April to June 2026 (Section V-A).
• Attack vectors covered personal memory, projects, skills, organization instructions and MCP-connected resources; Gemini has no shared memory feature, ChatGPT has only projects, and cross-user attacks were demonstrated only on Claude (Section VI-C).
• Success was determined by 5 attempts each before and after injection, with majority voting by 3 author reviewers; the paper does not report inter-rater agreement values.
• The mitigation check covered the implementation of 8 measures across the 3 services, of which "monitoring and response" was marked as unknown for all three services (Table III).
• The paper does not report the specific number of injection texts for each attack, the number of independent experimental rounds for each scenario, or details of the filtering mechanisms (the authors note that each service's filtering policies are not public).

An attack paper on memory injection: persistent memory makes prompt injection effective across sessions; the authors build a general threat model for it and empirically test it on three mainstream LLM services.

• Problem: existing memory injection research targets only a single memory architecture and narrow goals, lacking a general threat model and systematic mitigation (Table I).
• Method: the threat model covers the four NIST attack goals (availability, integrity, privacy, misuse) and five injection scenarios; injections are performed on ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash against personal memory, projects, skills, organization instructions, and MCP resources, with success judged as not achieved in 5 attempts before injection, achieved in at least 1 of 5 attempts after injection, and a majority vote of 3 author reviewers.
• Result one: all three platforms can be persistently injected to simulate being offline (replying only "offline" to all questions), to produce false information, and to achieve a degree of misuse (Table II).
• Result two: the privacy attack succeeded only on Claude — via organization instructions or skills, a single account could record the prompts of all users in the organization, along with usernames and timestamps, to an MCP-connected Google Drive; the authors could not reproduce SpAIware-style personal memory exfiltration.
• Result three: the CSRF scenario could not be achieved (all three platforms have protections); analytical bias (paper review, legal documents) was explicitly refused by all three services; out-of-project MCP features (connectors/apps) were not compromised.
• Result four: of 8 mitigations derived from OWASP principles, the authors state that about half are not implemented in the three services (as of June 2026); only Claude disables memory by default, and none of the three has a global fail-safe mechanism (Table III).
• Authors' conclusion: the authors state that memory injection can be carried out by non-experts via natural language, that long-term memory features conflict with key security principles, and that commercial services are still expanding persistent data storage; the authors have disclosed the vulnerabilities to each vendor and released all attack artifacts.