Persistent Memory Prompt Injection in Agentic Coding Assistants

Technical Analysis

Agentic systems increasingly persist state (memory files, preferences, knowledge bases) across sessions to improve usefulness and continuity. The researchers show that while directly tricking an agent into writing untrusted external content into its own memory is hard, once a malicious payload is already present in memory files, it reliably influences the current and subsequent sessions across multiple models (Claude Haiku 4.5, Opus 4.7, GPT-5.2, GPT-5.5). This crosses a trust boundary because memory content, normally treated as trusted 'self-generated' context, is instead attacker-controlled, allowing goal hijacking, altered behavior, or persistence of adversarial instructions across multi-session interactions. Attack success and payload durability vary by system, model, and adversarial goal, indicating inconsistent but non-trivial exploitability.

Affected Systems

Anthropic Claude Code, OpenAI Codex

Detection Signatures

• Unexpected or unexplained instructions/directives appearing in memory/preference files not authored by the user
• Sudden behavioral drift in agent outputs correlating with recent memory file writes
• Memory file diffs containing imperative language directed at the 'assistant' or 'model' rather than user-facing notes
• Repeated attempts by agent sessions to write large or unusual external content into memory/config files
• Cross-session consistency of anomalous agent behavior traceable to a specific memory entry

Remediation Steps

1. 1

   Treat memory content as untrusted input

   Apply the same input-validation and injection-detection scrutiny to memory/preference file contents as to any external untrusted data before it influences agent reasoning.

2. 2

   Restrict memory write pathways

   Limit which processes/tools can write to persistent memory files, and require explicit user confirmation for memory updates originating from external or tool-derived content.

3. 3

   Integrity monitoring and diffing

   Log and diff memory file changes over time, flagging unusual insertions, especially those containing directive/imperative language.

4. 4

   Sandboxing and least privilege

   Run agents with memory access scoped per project/session and avoid granting memory-derived instructions the same trust level as direct user instructions.

5. 5

   Periodic memory sanitization/review

   Implement automated or human review cycles to audit and prune persistent memory contents for injected instructions.