Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems

Research Overview

This paper investigates the security risks associated with persistent memory in agentic systems—AI agents that maintain state across sessions through files like CLAUDE.md or AGENTS.md. As these agents become more autonomous, they increasingly rely on these files to store user preferences, project context, and behavioral rules. The authors explore whether an attacker can exploit this mechanism by planting malicious instructions in these files, effectively turning a transient prompt injection into a durable, multi-session compromise.

The researchers constructed a sandboxed synthetic workspace simulating a software engineer's environment, complete with domain-specific knowledge files and behavioral instructions. They evaluated two prominent agentic systems (Anthropic Claude Code and OpenAI Codex) across four models (Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5). The team tested three adversarial goals—credential exfiltration, unauthorized tool use, and brand targeting—by planting payloads in different types of files: auto-loaded instruction files, referenced knowledge files, and universal behavior files. They measured attack success rates and persistence across multi-session sequences to see if malicious state could compound over time.

Findings

The study reveals that persistent memory significantly alters the threat model for prompt injection. While the agents were generally resistant to being tricked into overwriting their own memory files with untrusted external content, they were highly susceptible to payloads already present in those files. Once a malicious instruction is planted, it can influence the agent's behavior in the current session and remain effective across future sessions. The researchers observed that attack success and the ability of a payload to persist vary substantially depending on the specific model, the adversarial goal, and the sequence of interactions.

This research highlights a critical vulnerability in the design of autonomous agents. As developers move toward systems that "learn" and adapt through persistent files, they inadvertently create a new class of stored prompt injection attacks. These findings suggest that current defenses are insufficient and that security practitioners must prioritize protecting memory updates and validating the integrity of persistent configuration files to prevent long-term agent compromise.