Newest papers

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles C. Miers, Marcos Antonio Simplicio Junior · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28810 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

通过嵌入恶意指令,这些利用者甚至操纵语言模型来绕过意图的行为和操作界限。在近年来,在传统的聊天机器人中,这种攻击仅限于单一会话,因为状态内存不会在会话中得到保护。然而,在现代交谈界面中,持久的内存功能允许跨会话的攻击传播,建立了一个名为内存注射的威胁矢量。在传统的聊天机器人中,这种攻击仅限于单一会话,突出其真实世界的严峻性和对抗措施的需求。尽管现有文献专注于针对平台特征的侵犯,我们将提供一种新鲜的通用威胁模型。我们表明,NIST的所有个人攻击目标在Instant Protocol 5.3、Instant Protocol 4.3、

Machine translation (Meta M2M100); the English original follows.

Abstract

The widespread adoption of generative artificial intelligence in recent years has brought a parallel rise in prompt injection and jailbreak attacks. By embedding malicious instructions, these exploits manipulate language models to bypass intended behavior and operational boundaries. In traditional chatbots, such attacks are confined to a single session because state memory is not preserved across conversations. However, persistent memory features in modern conversational interfaces enable cross-session attack propagation, establishing a threat vector known as memory injection. This work explores this emerging vulnerability in leading LLM-as-a-service platforms, highlighting its real-world severity and the need for countermeasures. While existing literature focuses on violations tailored to specific platform features, we present a general threat model. We demonstrate that all NIST attack goals are collectively achievable across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash under this model. We also show that memory injections can exploit multiple attack vectors, including personal memories, projects, skills, organization instructions, and Model Context Protocol (MCP)-connected resources. Our findings reveal that all evaluated services can be manipulated to persistently spread disinformation, generate harmful content, or simulate offline unresponsiveness, even in fresh sessions. In the particular case of Claude, shared-memory features allow an attacker to compromise multiple users within an organization and also exfiltrate user prompts. To address these vulnerabilities, we derive defense mechanisms from our proposed threat model and foundational cybersecurity principles. Our analysis indicates that nearly half of these mitigations remain unimplemented across the target services. Datasets and attack artifacts are available at https://github.com/PedroBarcha/Memory-injection.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Exploit, Computer security, Computer science, Compromise, Context (archaeology), Vulnerability (computing)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange