In the evolving landscape of agentic systems, persistent state is maintained through memory files, behavioral preferences, and knowledge bases. While this enhances the utility and self-improvement of agents, it also introduces a new attack surface for prompt injection.
This paper investigates prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace.
We evaluate two agentic systems: Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5.
Our findings indicate that while it is challenging for an agent to overwrite its own memory files with untrusted external content, payloads already embedded in those files can successfully influence current and future sessions.
The success rate of attacks and the persistence of payloads vary significantly across systems, models, adversarial goals, and multi-session attack sequences.
These insights reveal that persistent memory alters the threat model for prompt injection, motivating the development of defenses that protect memory updates without eliminating beneficial agent adaptation.
Blogger's Review: This paper provides a critical examination of the tension between memory usage and security in agentic systems, emphasizing the need for robust defenses against potential prompt injection attacks while allowing for effective agent adaptation. It raises important considerations for the future of intelligent systems.