Newest papers

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles C. Miers, Marcos Antonio Simplicio Junior · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28810 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

A ameaçada adoção de inteligência artificial geradora nos últimos anos trouxe um aumento paralelo em ataques de injeção rápida e jailbreak. Ao incorporar instruções maliciosas, esses exploits ainda manipulam modelos de linguagem para contornar o comportamento pretendido e os limites operacionais. Em chatbots tradicionais, tais ataques estão confinados a uma única sessão porque a memória de estado não é preservada em conversas. No entanto, recursos de memória persistentes em interfaces de conversação modernas permitem a propagação de ataques de meio período, estabelecendo um vetor de ameaça conhecido como injeção de memória. Este trabalho explora esta vulnerabilidade emergente nas principais plataformas LLM-as-a-service, destacando a gravidade do seu conteúdo do mundo real e a necessidade de contramedidas. Enquanto

Machine translation (Meta M2M100); the English original follows.

Abstract

The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By embedding malicious instructions, these exploits manipulate language models to bypass intended behavior and operational boundaries. In traditional chatbots, such attacks are confined to a single session because state memory is not preserved across conversations. However, persistent memory features in modern conversational interfaces enable cross-session attack propagation, establishing a threat vector known as memory injection. This work explores this emerging vulnerability in leading LLM-as-a-service platforms, highlighting its real-world severity and the need for countermeasures. While existing literature focuses on violations tailored to specific platform features, we present a general threat model. We demonstrate that all NIST attack goals are collectively achievable across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash under this model. We also show that memory injections can exploit multiple attack vectors, including personal memories, projects, skills, organization instructions, and Model Context Protocol (MCP)-connected resources. Our findings reveal that all evaluated services can be manipulated to persistently spread disinformation, generate harmful content, or simulate offline unresponsiveness, even in fresh sessions. In the particular case of Claude, shared-memory features allow an attacker to compromise multiple users within an organization and also exfiltrate user prompts. To address these vulnerabilities, we derive defense mechanisms from our proposed threat model and foundational cybersecurity principles. Our analysis indicates that nearly half of these mitigations remain unimplemented across the target services. Datasets and attack artifacts are available at https://github.com/PedroBarcha/Memory-injection.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Exploit, Computer security, Computer science, Compromise, Context (archaeology), Vulnerability (computing)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange