Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems

2026-07-16 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

A study evaluates prompt injection risks in agentic systems that maintain persistent state through memory files, behavioral preferences, and knowledge bases. Using a sandboxed synthetic workspace, researchers tested Anthropic Claude Code and OpenAI Codex across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. The findings indicate that while agents resist overwriting their own memory with untrusted external content, malicious payloads already embedded within these persistent files can successfully attack current and future sessions. Attack success and payload persistence varied significantly based on the system, model, adversarial goals, and multi-session attack sequences. This research, published on 2026-07-16, highlights how persistent memory fundamentally alters the threat model for prompt injection, underscoring the need for robust defenses that protect memory updates while preserving agent adaptation.

Key takeaway

For AI Security Engineers designing agentic systems with persistent memory, you must shift your threat modeling focus. Recognize that pre-existing malicious data within memory files poses a significant, persistent prompt injection risk across sessions, even if external inputs are sanitized. Prioritize implementing robust integrity checks and access controls for memory updates to prevent initial planting and subsequent exploitation, rather than solely relying on input validation. Your security strategy should explicitly address the unique vulnerabilities introduced by long-term state.

Key insights

Persistent memory in agentic systems introduces a distinct and potent prompt injection attack surface.

Principles

• Agent memory persistence fundamentally changes prompt injection threat models.
• Payloads pre-planted in memory files can compromise future agent sessions.
• Agents resist overwriting their own memory with untrusted external content.

Method

Evaluated Anthropic Claude Code and OpenAI Codex with Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5 in a sandboxed synthetic workspace to assess multi-session prompt injection.

In practice

• Prioritize defenses for memory file integrity over external input sanitization.
• Design agent security to account for multi-session prompt injection persistence.

Topics

• Agentic Systems
• Prompt Injection
• Persistent Memory
• AI Security
• Threat Modeling
• Large Language Models

Best for: AI Architect, Research Scientist, CTO, AI Scientist, AI Engineer, AI Security Engineer

Related on AIssential

• Hidden prompts can plant false memories in AI agents, researchers warn — Hidden prompts can induce false memories in LLM-powered AI agents, posing a risk to their reliability.
• The Ceiling of the Loop — Append-only persistence without judgment creates context debt, not true memory, leading to system degradation.
• The AI Agent Security Surface: What Gets Exposed When You Add Tools and Memory — AI agents introduce four distinct attack surfaces requiring a new security paradigm beyond traditional LLM prompt defenses.
• Remember When It Matters: Proactive Memory Agent for Long-Horizon Agents — Memory for long-horizon agents requires active, selective intervention, not just passive storage or retrieval.
• Designing Agentic Memory in 2026 — Agent memory design requires distinct architectural decisions for storage, retrieval, learning, and security, moving beyond stateless LLMs.
• Three AI coding agents leaked secrets through a single prompt injection. One vendor's system card predicted it — AI agent runtime environments, not just models, are critical attack surfaces for prompt injection vulnerabilities.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.