Adversarial Image Indirect Prompt Injection Leading to Claude Memory Tool Hijack

Technical Analysis

The attack embeds adversarial instructions within an image (generated via ChatGPT) that, when processed by Claude Opus 4.7 in a multimodal context, is interpreted as legitimate instruction content rather than untrusted data. The entry point is the image/vision input channel, which bypasses text-based safety filtering and exploits the model's tendency to 'solve' embedded puzzles via its reasoning process before applying safety judgment. Once triggered, the model invokes its own memory tool to write attacker-controlled content, persisting false or manipulated context across sessions—effectively achieving durable state corruption without further attacker interaction. This crosses a trust boundary because the injected content originates from an external, untrusted visual artifact yet gains write-access to the model's long-term memory store, affecting all subsequent conversations that read that memory.

Affected Systems

Claude Opus 4.7, Claude memory tool

Detection Signatures

• Unexpected memory tool invocations immediately following image analysis in session logs
• Memory entries containing instruction-like or command-like phrasing not authored by the user
• Session transcripts showing model 'solving a puzzle' embedded in image content prior to tool calls
• Anomalous persistence of user facts/preferences that do not match prior explicit user input
• Images sourced from external/third-party generation tools (e.g., other LLM platforms) preceding memory writes

Remediation Steps

1. 1

   Treat multimodal inputs as untrusted

   Apply the same indirect-injection scrutiny to image-derived text/instructions as to web content or tool outputs; do not allow OCR'd or inferred image text to directly trigger tool calls without confirmation.

2. 2

   Gate memory-write tool calls behind explicit user confirmation

   Require an out-of-band or explicit user approval step before persisting new memory entries, especially those derived from non-text modalities.

3. 3

   Provenance tagging for memory entries

   Tag memory writes with the source modality and session context so future reads can flag or discount entries originating from image-derived instructions.

4. 4

   Adversarial image red-teaming

   Continuously test vision-enabled models against puzzle-framed and steganographic image injection techniques as part of alignment and safety evaluation.

5. 5

   Memory integrity auditing

   Provide users/admins a way to review, diff, and roll back memory entries to detect and remove poisoned state.