Memory injection: planted orders outlive the chat session
A new paper reports that injections stored in assistant memory keep acting in sessions that start clean.
· arXiv · Research by Pedro H. Barcha Correia (Universidade de São Paulo), Matheus Azevedo de Sá (Universidade do Estado de Santa Catarina), Paulo H. Gomes de Senna (Universidade do Estado de Santa Catarina), Giovanni Mandel Martignago (Universidade do Estado de Santa Catarina), Victor Takashi Hayashi (Universidade de São Paulo), Universidade de São Paulo, Universidade do Estado de Santa Catarina
Researchers at USP and UDESC report that prompt injections planted in the long-term memory of ChatGPT, Claude and Gemini persist into later sessions, and that all four NIST attack goals are collectively achievable.
01What happened
Pedro H. Barcha Correia and colleagues at the Universidade de São Paulo and the Universidade do Estado de Santa Catarina posted the paper to arXiv on October 20, 2026. The authors tested memory injection against three commercial services, ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash, and report that the four attack goals in NIST's adversarial machine learning taxonomy are collectively achievable. The paper states the providers were notified before submission, and records no vendor response.
02How it works
Memory injection stores a prompt injection inside a feature built to remember, so the instruction reloads in later conversations instead of ending with the session. The authors used personal memories, projects, skills, organization instructions and MCP-connected resources as the storage, and judged each attack by majority vote of three reviewers comparing five attempts before and after injection. On Claude, shared memory features carried the injection to other users in the same organization, which is the only path by which the privacy goal succeeded.
03Who is affected
Users of the three tested services with long-term memory features enabled are in scope, and the organization-wide exposure the authors describe applies to Claude workspaces using shared memory, projects or organization instructions. The authors report that the privacy compromise goal failed on ChatGPT and Gemini, while availability breakdown, integrity violation and misuse enablement succeeded on all three, integrity on Claude only through shared memory.
04What to do
Review which memory, project and organization-instruction features your assistants have enabled, and inspect stored memories for instructions nobody added deliberately. The authors derive defenses from their threat model and report that nearly half of the mitigations they suggest remain unimplemented by the tested services, so treating assistant memory as attacker-writable storage is the safer assumption.
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2github.comReproduction Artifacts