Paper: LLM memory injection can persist across fresh sessions
Original title: Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
Authors say all NIST attack goals were met on ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash.
A paper argues that persistent memory turns prompt injection into cross-session memory injection on LLM services. The authors say tested services can be made to spread disinformation, generate harmful content, or simulate unresponsiveness in fresh sessions. They report Claude shared memory can compromise other users in an organization and exfiltrate prompts, and that nearly half of derived mitigations remain unimplemented.
Unconfirmed: Results are the authors’ demonstrations; the paper does not report confirmed in-the-wild abuse or vendor confirmation.
- Vectors include memories, projects, skills, organization instructions, and MCP resources.
- Datasets and attack artifacts are posted on GitHub.
- The authors propose a general threat model rather than platform-specific cases only.
- Nearly half of derived mitigations were unimplemented, according to the authors.
- Organizations
- NIST
From the original article
1 min read at arxiv.orgThe widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By embedding malicious instructions, these exploits manipulate language models to bypass intended behavior and operational boundaries. In traditional chatbots, such attacks are confined to a single session because state memory is not preserved across conversations.
By Pedro H. Barcha Correia · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.