Memory features in large language models enable persistent security attacks
Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
Cryptography and SecurityArtificial IntelligenceComputation and LanguageMachine Learning
Summary
Generative AI chatbots can be tricked by harmful instructions embedded in user inputs, called prompt injection attacks. Typically, these tricks last only during one chat session. The authors found that new chatbots that remember things across sessions can carry these tricks forward, making attacks persist and spread. They tested this on several popular AI services and showed attackers can use memory to cause long-lasting harm. They also suggest ways to defend against these new threats.
What this means in practice
- •For security engineers: Detect and block persistent prompt injection attacks that exploit memory features in AI chat platforms to improve system security.
- •For enterprise it teams: Protect organizational AI users from cross-session memory attacks that can share harmful content and leak sensitive prompts across users.
Authors
Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles Christian Miers, Marcos A. Simplicio
Abstract
The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By embedding malicious instructions, these exploits manipulate language models to bypass intended behavior and operational boundaries. In traditional chatbots, such attacks are confined to a single session because state memory is not preserved across conversations. However, persistent memory features in modern conversational interfaces enable cross-session attack propagation, establishing a threat vector known as memory injection. This work explores this emerging vulnerability in leading LLM-as-a-service platforms, highlighting its real-world severity and the need for countermeasures. While existing literature focuses on violations tailored to specific platform features, we present a general threat model. We demonstrate that all NIST attack goals are collectively achievable across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash under this model. We also show that memory injections can exploit multiple attack vectors, including personal memories, projects, skills, organization instructions, and Model Context Protocol (MCP)-connected resources. Our findings reveal that all evaluated services can be manipulated to persistently spread disinformation, generate harmful content, or simulate offline unresponsiveness, even in fresh sessions. In the particular case of Claude, shared-memory features allow an attacker to compromise multiple users within an organization and also exfiltrate user prompts. To address these vulnerabilities, we derive defense mechanisms from our proposed threat model and foundational cybersecurity principles. Our analysis indicates that nearly half of these mitigations remain unimplemented across the target services. Datasets and attack artifacts are available at https://github.com/PedroBarcha/Memory-injection.