Memory attacks continue across sessions in ChatGPT, Claude and Gemini
Planted memory instructions work in new sessions, and almost half of the defenses in the paper are not in use.
Claimed, not confirmed
Researchers show that an attacker can plant instructions in the long-term memory of a chat service. This is memory injection. The instructions stay active in subsequent sessions. The researchers did tests on three top chat services. All three could give incorrect information, make dangerous content or look as if they do not answer. This was also true in new sessions.
How it works
Chat services keep memory across sessions. An attacker can plant an instruction in that memory. The instruction then works in subsequent sessions.
The results
The researchers did tests on three services:
All the attack goals were possible on all three. In Claude, shared memory lets an attacker attack many users in one organization and get their prompts.
What is not known
The abstract gives no success rates. The authors found that almost half of the defenses in the paper are not in use on these services.
Insight: Memory turns a one-time attack into a lasting one
In a public challenge, GPT-4o had a 58% attack success rate and GPT-5 mini had 47%, in an email task. This paper shows that memory lets one success continue in new sessions. Each memory function reads as a position where attackers can stay. The next move to monitor is if vendors close the missing defenses. Leaders must see shared memory as data that attackers can change.
Sources
Posted
