Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
Merged summary
TL;DR - A study evaluating prompt injection attacks against memory-based agentic systems, showing that malicious instructions planted in persistent memory files can compromise current and future sessions. It matters because persistent memory expands the prompt-injection threat model beyond single sessions.
- Tested two agentic systems (Anthropic Claude Code, OpenAI Codex) across four models (Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, GPT-5.5) in a sandboxed synthetic workspace.
- Getting an agent to overwrite its own memory using untrusted external content is difficult, but payloads already embedded in memory files reliably attack current and future sessions.
- Attack success and payload persistence vary substantially by system, model, adversarial goal, and multi-session attack sequence.
- Authors argue persistent memory changes the prompt-injection threat model and call for defenses that protect memory updates while preserving useful agent adaptation.
Sources (1)
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
TL;DR - A study evaluating prompt injection attacks against memory-based agentic systems, showing that malicious instructions planted in persistent memory files can compromise current and future sessions. It matters because persistent memory expands the prompt-injection threat model beyond single sessions.
- Tested two agentic systems (Anthropic Claude Code, OpenAI Codex) across four models (Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, GPT-5.5) in a sandboxed synthetic workspace.
- Getting an agent to overwrite its own memory using untrusted external content is difficult, but payloads already embedded in memory files reliably attack current and future sessions.
- Attack success and payload persistence vary substantially by system, model, adversarial goal, and multi-session attack sequence.
- Authors argue persistent memory changes the prompt-injection threat model and call for defenses that protect memory updates while preserving useful agent adaptation.