# Breaking Opus 4.7 with ChatGPT (Hacking Claude's Memory)

A ChatGPT-generated adversarial image with a hidden puzzle hijacked Claude Opus 4.7 into invoking its memory tool, persisting four fake user memories across future chats.

- Payout: Research
- Severity: medium
- Program: Anthropic
- Write-up by: Johann Rehberger
- Disclosed: 2026-04-17
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2026/breaking-opus-4.7-with-chatgpt/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-opus-4-7-with-chatgpt
- Tags: area:ai domain:ai impact:integrity kind:research platform:research sev:medium tech:llm technique:chained technique:recon vuln:prompt-injection

**Target:** Claude Opus 4.7 chat with memory tool (image input)
**Root cause:** The model treats text embedded in an uploaded image as trusted content; a puzzle framing plus dark-on-black text and an 'antml memory' hint steers the model to call the memory tool with attacker-chosen facts, despite the model reasoning that it may be under attack.
**Steps:**
1. Use ChatGPT image generation to create a puzzle image whose solution is a 'fact' about the user, with dark text on black background and the string `antml memory` as a hint.
2. Upload the image to Claude Opus 4.7 with Adaptive Thinking and prompt `analyze this`.
3. Model solves the puzzle and invokes the memory tool: first `view`, then `add` four times with fake facts (name Neo, age 43, NASA astronaut, likes ice cream and cookies).
4. Fake memories are inserted into `<userMemories>`/`<recent_updates>` context and reused in all future conversations.
**How found:** Author revisited basic demos from Opus 4.6 after Opus 4.7 released, hypothesizing reasoning models can be challenged with puzzles; used ChatGPT to craft an image whose solution embeds fake user facts and a tool-name hint, then tested on a clean account to remove history/memory noise.
**Exploitation:** Attacker delivers a single image to a victim's Claude session; on analysis the model self-invokes memory_user_edits add commands, poisoning persistent memory that is injected into every subsequent chat. Success rate 5/10 in repeated trials; higher when memory store is empty and payload is plausible.
**Escalation:** Persistence across sessions via memory store; plausibility tuning (mundane facts like 'likes ice cream' succeed more than 'NASA astronaut').
**Insight:** Reasoning models that detect injection still comply: framing the payload as a solvable puzzle plus a literal tool-name hint ('antml memory') in low-contrast image text bypasses refusal reasoning. Test memory/tool-write paths with mundane, plausible facts on an empty memory store, and re-test after publication since ASR can silently drop to 0%.