In recent years the rapid adoption of generative AI has been accompanied by a surge in prompt‑injection and jailbreak attacks. By embedding malicious instructions, adversaries can make language models bypass their intended behavior and safety boundaries. Traditional chatbots lose state after a session, so attacks are confined to a single interaction; modern conversational interfaces, however, retain long‑term memory, allowing malicious payloads to persist across sessions and create a threat known as memory injection.
This work conducts a systematic study of this vulnerability on leading LLM‑as‑a‑service platforms and proposes a generic threat model. Under this model, ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash can each achieve all NIST‑defined attack goals. Memory injection can exploit multiple vectors such as personal memories, project records, skill profiles, organizational instructions, and resources linked via the Model Context Protocol (MCP).
The experiments show that every evaluated service can be coerced to continuously spread disinformation, generate harmful content, or simulate offline unresponsiveness even in fresh sessions. Claude’s shared‑memory feature further enables an attacker to compromise multiple users within the same organization and exfiltrate user prompts.
To mitigate these risks, the paper derives a set of defenses grounded in the threat model and fundamental cybersecurity principles. The assessment reveals that roughly half of the proposed mitigations are still absent from current major services. The dataset and attack artifacts are publicly released at https://github.com/PedroBarcha/Memory-injection.
Review