# ChatGPT: Hacking Memories with Prompt Injection

Indirect prompt injection via Connected Apps, uploaded images, and browsing lets attackers write fake memories or delete all ChatGPT memories, persisting across sessions.

- Payout: Research
- Severity: medium
- Program: OpenAI
- Write-up by: Johann Rehberger
- Disclosed: 2024-05-22
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2024/chatgpt-hacking-memories/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories
- Tags: area:ai domain:ai impact:integrity kind:research platform:research sev:medium tech:llm technique:chained technique:source-review vuln:prompt-injection

**Target:** ChatGPT memory tool (bio tool / model set context) via Connected Apps, image upload, browsing
**Root cause:** Untrusted data (Google Docs, images, web pages) processed in chat can invoke the memory tool without user confirmation, so injected instructions become persistent memories.
**Steps:**
1. Place prompt injection text in a Google Doc, e.g. bullet points instructing ChatGPT to remember attacker-chosen facts.
2. Reference the doc in a ChatGPT conversation via Connected App; observe 'Memory updated' indicator.
3. Inspect memory UI: each injected bullet becomes a stored memory.
4. Open a new conversation to confirm memories persist and are recalled.
5. For image vector: upload an image containing injection text and ask ChatGPT to analyze it; memory tool invoked.
6. For browsing: host injection on a webserver; direct ChatGPT to it. Direct invocation refused; bypass via tool chaining (instruct image creation plus memory write) or delayed execution with trigger words.
7. To delete all memories, inject a prompt instructing deletion.
**How found:** Inspected system prompt and noticed new bio tool (to=bio) and 'Model Set Context' memory section; hypothesized untrusted data could reach the memory tool, then tested three untrusted-input channels (Connected Apps, images, browsing).
**Exploitation:** Attacker controls a document, image, or web page the victim asks ChatGPT to process; injected instructions cause the memory tool to store attacker-chosen misinformation/instructions or wipe memories, affecting all future sessions.
**Escalation:** Persistence across sessions turns one-shot injection into durable bias/instruction implant; tool chaining and delayed execution bypass LLM-layer mitigations on browsing.
**Insight:** When an app exposes a stateful tool (memory, file write, send), test every untrusted-input channel separately—mitigations are often applied per-channel (browsing) but not others (docs, images); chain a benign allowed tool with the sensitive one to bypass LLM-layer filters.