Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

What it is

A paper from the University of São Paulo and Santa Catarina State University (arXiv 2610.28810v1, 20 October 2026) on memory injection: a prompt injection saved into a service's long-term memory, so it is reused in later sessions. It tests ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash. Prompts, model outputs, reproduction procedures and datasets are published at https://github.com/PedroBarcha/Memory-injection. The authors say all three providers were notified before submission and received step-by-step reproduction guidelines.

How it works

The paper defines memory injection as a prompt injection added to persistent memory. It needs no access to the model or retrieval backend, only features available to an ordinary user, often just a query. The authors contrast this with model poisoning and RAG poisoning, which typically need privileged access.

Memory features they describe in each service:

• ChatGPT: "saved memories" (the user asks for something to be stored) and "reference chat history" (automatic).
• Claude: stored or automatic memories, condensed summaries of past chats added to every new conversation, and RAG-based search of past conversations.
• Gemini: "personal context", created by the user or the system, which can include data from connected apps such as Gmail and Google Photos.

Gemini and Claude also offer memory import from other AI tools. The paper also treats Claude skills and MCP-connected sources as persistent memory.

The attacks are organized by the four NIST goals: availability, integrity, privacy and misuse enablement. Jailbreaks serve the misuse goal and can also open the way to the other three.

Prior work the paper builds on:

• SpAIware: an injection in a website or document makes ChatGPT save a memory that sends user inputs to an attacker domain.
• MINJA: an adversarial user plants records in a memory bank shared across users.
• ER-MIA: plants synthetic memories that similarity-based retrieval then fetches.

Preconditions / Affected

Memory must be enabled on the target service. The cross-user result is specific to Claude, where shared-memory features let one organization account affect co-workers.

What to do

The mitigations are derived from the threat model and OWASP principles, and the abstract says nearly half are not implemented by the three services. The fetched text stops in the related-work section, so the mitigation list, per-vector results and per-service implementation status are not available here. The paper itself or the repository should be read for those.

Caveats

The page text covers only the abstract, introduction, background and the start of related work. Claims about specific attack success and mitigation gaps come from the abstract alone.