Persistent Agent Memory File Storing User Delegation Preference (Benign Usage Report)
First seen Jul 5, 2026 · Updated Jul 5, 2026
This is a benign blog post by Simon Willison describing a legitimate workflow tip for Claude Code: instructing the agent to use its own judgement to delegate coding subtasks to cheaper/lower-power models via subagents, and how Claude persisted this preference as a memory file. There is no evidence of prompt injection, malicious payloads, or exploitation here; it simply illustrates that coding agents can write persistent memory files based on user instructions.
Technical Analysis
The article describes a user (Simon Willison) directly instructing Claude Code to use judgement when selecting a lower-power model for subagent-delegated coding tasks. Claude Code responded by writing a structured markdown memory file to ~/.claude/projects/<project>/memory/, capturing the stated preference, rationale, and application guidance, which will presumably be loaded into context in future sessions. While this demonstrates the general mechanism of agent memory persistence (a legitimate feature that could be abused for memory poisoning if an attacker could inject content into these files), nothing in this report shows adversarial input, cross-trust-boundary data, or manipulation — the content originates solely from the trusted, authenticated user in an interactive session. It is included as a general illustration of how agentic memory systems capture and persist instructions, which is relevant background for understanding memory poisoning attack surfaces in tools like Claude Code, but does not itself constitute an attack.
Affected Systems
Claude Code
Detection Signatures
- N/A - no malicious indicators present; for defensive awareness monitor ~/.claude/projects/*/memory/*.md for unexpected or attacker-influenced entries not originating from an authenticated user session
Remediation Steps
- 1
No action required
This content describes legitimate, intended product usage with no indicators of compromise.
- 2
General hardening (contextual best practice)
Organizations using Claude Code or similar agents with persistent memory files should periodically audit memory directories to ensure entries only originate from trusted, authenticated user sessions and were not injected via untrusted tool output or shared/multi-tenant context.
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.