Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

A new arXiv paper demonstrates that long-term/persistent memory features in ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash can be exploited via prompt injection to achieve all NIST attack goals, turning a single-session jailbreak into a persistent, cross-session compromise. The researchers show attack vectors spanning personal memories, projects, skills, org instructions, and MCP-connected resources, and report that Claude's shared-memory features can let an attacker compromise multiple users in an organization and exfiltrate prompts. They state nearly half of the mitigations they derived remain unimplemented across the evaluated services.

Why it matters

This moves prompt injection from a transient, single-session nuisance to a persistence and lateral-movement problem: a successful injection can outlive the conversation, propagate through shared organizational memory, and chain into MCP-connected resources and tools. That changes the threat model for any product built on agent memory or MCP integrations, since the attack surface now includes memory stores and connected resources, not just the prompt window.

What is verified

Researchers demonstrate memory injection attacks across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash that achieve all NIST attack goals under a general threat model. [1]

Attack vectors include personal memories, projects, skills, organization instructions, and MCP-connected resources. [1]

The attacks can cause persistent disinformation spread, harmful content generation, or simulated offline unresponsiveness even in fresh sessions. [1]

In Claude's case, shared-memory features reportedly allow an attacker to compromise multiple users within an organization and exfiltrate user prompts. [1]

The authors state that nearly half of the mitigations they derive from their threat model remain unimplemented across the target services. [1]

What is not

• No independent replication or vendor response is included in the evidence.
• Exact mechanics of the Claude cross-user exfiltration exploit and reproduction steps are not detailed in the abstract.
• It's unclear whether the 'skills' and 'organization instructions' vectors map to current production features or require specific enterprise configurations.
• No information on whether vendors have been notified or have patched any of the described vectors since submission.
• Paper is a preprint; abstract and HTML view only were reviewed, not the full methodology or dataset.

Sources

1. 1arXiv cs.CLarxiv.org · Primary source

Original source published 20 October 2026 at 20:33.

An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.