Study reveals LLM long-term memory can be persistently attacked via memory injection

Researchers from the University of São Paulo and other institutions proposed in a paper a general threat model for memory injection against LLM long-term memory, and empirically demonstrated persistent attacks on ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash covering the four attack objectives of NIST availability, integrity, privacy and misuse. The injection is planted through persistent memory carriers such as personal memory, projects, skills, organizational instructions and MCP-connected resources, and can persistently spread false information, generate harmful content or simulate service outages across entirely new sessions. Among these, Claude's shared memory can let a single account within an organization compromise other users; the authors successfully recorded and exfiltrated user prompts via organizational instructions and a Google Drive connector. The authors derived multiple mitigations from OWASP security principles, noted that nearly half have not yet been implemented in the three services, and notified the vendors in advance under responsible disclosure; the attack artifacts are published at github.com/PedroBarcha/Memory-injection.