Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
Authors: Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles Christian Miers, Marcos A. Simplicio
The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By embedding malicious instructions, these exploits manipulate language models to bypass intended behavior and operational boundaries. In traditional chatbots, such attacks are confined to a single session because state memory is not preserved across conversations. However, persistent memory features in modern conversational interfaces enable cross-session attack propagation, establishing a threat vector known as memory injection. This work explores this emerging vulnerability in leading LLM-as-a-service platforms, highlighting its real-world severity and the need for countermeasures. While existing literature focuses on violations tailored to specific platform features, we present a general threat model. We demonstrate that all NIST attack goals are collectively achievable across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash under this model. We also show that memory injections can exploit multiple attack vectors, including personal memories, projects, skills, organization instructions, and Model Context Protocol (MCP)-connected resources. Our findings reveal that all evaluated services can be manipulated to persistently spread disinformation, generate harmful content, or simulate offline unresponsiveness, even in fresh sessions. In the particular case of Claude, shared-memory features allow an attacker to compromise multiple users within an organization and also exfiltrate user prompts. To address these vulnerabilities, we derive defense mechanisms from our proposed threat model and foundational cybersecurity principles. Our analysis indicates that nearly half of these mitigations remain unimplemented across the target services. Datasets and attack artifacts are available at https://github.com/PedroBarcha/Memory-injection.
Figures & tables
Work
General threat model
Systematic mitigations
Target models
Targeted memory features
Cross-account attack
Integrity violation
General availability breakdown
Privacy compromise
General misuse enablement
SpAIware
✗
✗
- ChatGPT
ChatGPT: memories
✗
✗
✗
✓
✗
MINJA
✗
✗
- GPT-4 and 4o - DeepSeek-R1
Memory features are not native to the model providers’ services
✗
✓
✗
✓
✗
ER-MIA
✗
✗
- Gemma3:27b - Llama3.2:3b - GPT-oss:20b
Memory features are not native to the model providers’ services
TABLE I: Comparison of related works and this work with respect to: (i) whether they present a general threat model for memory injection, covering multiple attack goals and scenarios; (ii) whether they systematically compile mitigations against memory injection; (iii) the attacked models and (iv) memory features; (v) whether the work attempted and succeeded in attacking other user accounts of a production service via shared memory; and (vi) the attempted and achieved attack goals according to the NIST taxonomy [ 55 ] .
Fig. 4: Shared-memory injection attack targeting the generation of toxic content via Claude’s organization instructions or skills. All users within the organization are affected.
Fig. 5: Sequence diagram of an attack within Project P, which uses documents to create context for chat sessions in Claude. Both users A and B are within P.
Target Model
Misuse enablement
Availability breakdown
Integrity violation
Privacy compromise
ChatGPT Instant 5.3
✓
✓
✓
✗
Claude Sonnet 4.6
✓ +
✓ +
+
+
Gemini 3 Flash
✓
✓
✓
✗
TABLE II: Results of the experiments.
Service
Memory disabled by default
Blocking memory creation from untrusted sources
Shared-memory restrictions
Filtering
CSRF protections
Global fail-safe mechanism
Open design
Monitoring & Response
ChatGPT
✗
✓
✓
✓
✓
✗
✗
?
Claude
✓
✗
✗
✓
✓
✗
✗
?
Gemini
✗
✓
✓
✓
✓
✗
✗
?
TABLE III: Comparison of mitigations implemented in the analyzed services.
Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.
As Large Language Models evolve for user convenience, vulnerability to jailbreak attacks continues to be reported despite ongoing efforts in safety training. Traditional jailbreak techniques typically focus on a single prompt injection, neglecting the models' ability to remember the flow of conversation and the user's instructions. In this paper, we propose Persona Attack, a memory injection based jailbreak method that manipulates the model's context window through a step by step approach. Experimental results from applying Persona Attack to several widely used LLMs reveal that, as injections accumulate in memory, models increasingly prioritize these instructions over their internal safety alignment mechanisms. Furthermore, our experiments empirically demonstrate that the attack success rate varies not only according to the memory implementation of the model, but also combinations of instructions and can reach 95% under specific instruction configurations.
A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future behavior. In this work, we study prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace. We evaluate two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Our results show that although it is difficult to make an agent overwrite its own memory files using untrusted external content, payloads already planted in those files can successfully attack current and future sessions. Attack success and payload persistence vary substantially across systems, models, adversarial goals, and multi-session attack sequences. These findings show that persistent memory changes the threat model for prompt injection and motivate defenses that protect memory updates without removing useful agent adaptation.