Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems

Soham U. Gadgil David Alexander S. Sunku Franziska Roesner

Jul 2026 · arXiv.org · Vol abs/2607.14611 · 2 citations · ⚡ 1 influential · 33 references

Computer Science

TL;DR

This work evaluates two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models and shows that persistent memory changes the threat model for prompt injection and motivate defenses that protect memory updates without removing useful agent adaptation.

Abstract

A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future behavior. In this work, we study prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace. We evaluate two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Our results show that although it is difficult to make an agent overwrite its own memory files using untrusted external content, payloads already planted in those files can successfully attack current and future sessions. Attack success and payload persistence vary substantially across systems, models, adversarial goals, and multi-session attack sequences. These findings show that persistent memory changes the threat model for prompt injection and motivate defenses that protect memory updates without removing useful agent adaptation.

DOI arXiv Semantic Scholar

View source

Similar papers

Preprint Aug 2026

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

This work proposes InjecMEM, a novel memory injection attack paradigm that requires only a single interaction to steer later responses of related queries toward a pre-specified output and achieves reliable topic-conditioned retrieval and targeted generation.

Hanling Tian, Gengyu Zhang, Zeyang Sha et al. · 3 citations

Review Aug 2026

On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models

A four-layer taxonomy mapping 13 vulnerability types across perception, brain, action, and interaction layers is contributed, and seven open problems centered on containment are identified.

Md Jafrin Hossain, Mohammad Arif Hossain, Nirwan Ansari · 0 citations

#artificial intelligence Preprint Aug 2026

CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?

This work proposes Continuous Agents for Injection Threats via Lifelong Yielding Nexus (CAITLYN), an agent-agnostic defense middleware that matches the detection performance of state-of-the-art defenses at lower token overhead than LLM-as-a-judge baselines.

Zi Liang, XiaoYu Xu, Yanyun Wang et al. · 1 citation

Preprint Aug 2026

Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw

This paper introduces MemCollusion, an automated red-teaming framework for constructing collusive memory poisoning attacks, and develops MoltLab, a controlled research reproduction of Moltbook, in which crafted platform content must first be observed and distilled into persistent memory before influencing the agent's b...

Zheng Lin, Yuzhen Huang, Zhenxing Niu et al. · 0 citations

Preprint Aug 2026

SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains

This work introduces SynChain, a self-synthesized attack paradigm utilizing persistence-aware directed supervised fine-tuning to induce agents to create poisoned yet benign-looking artifacts, proving that securing CUAs requires provenance-aware reasoning over cross-task execution trajectories.

Fuyao Zhang, Jiaming Zhang, Che Wang et al. · 0 citations

Preprint Aug 2026

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

This work proposes a self-evolving test-time defense built around a persistent, cross-interaction rule memory that substantially reduces attack success rates while preserving benign utility, remains robust under an adaptive composite-wrapper attack, and does not increase over-refusal as the memory grows.

Tongshen Hu, Bryan Hooi · 0 citations