Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems

2026-07-16

AI Summary

This work identifies persistent memory mechanisms as a novel attack surface for prompt injection in agent systems, wherein malicious instructions embedded in memory files can manipulate both current and subsequent interactions. It systematically demonstrates for the first time that memory content itself can serve as an attack vector, thereby extending conventional threat models that rely solely on external inputs. To evaluate this vulnerability, we construct a sandboxed synthetic workspace that simulates memory files, behavioral preferences, and knowledge bases, enabling multi-turn, multi-session assessments across four major models from the Claude and GPT families. Experimental results reveal that while it remains difficult to induce agents to overwrite their own memories, pre-implanted memory payloads can effectively steer agent behavior, with attack success rates varying significantly based on system architecture, model type, and target task.

Abstract

A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future behavior. In this work, we study prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace. We evaluate two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Our results show that although it is difficult to make an agent overwrite its own memory files using untrusted external content, payloads already planted in those files can successfully attack current and future sessions. Attack success and payload persistence vary substantially across systems, models, adversarial goals, and multi-session attack sequences. These findings show that persistent memory changes the threat model for prompt injection and motivate defenses that protect memory updates without removing useful agent adaptation.

Problem

• prompt injection
• agentic systems
• persistent memory
• memory files
• adversarial attacks

Innovation

• prompt injection
• agentic systems
• persistent memory
• adversarial attacks
• memory security