# Persisted prompt injection via agent memory

Untrusted content writing agent memory that later replays as trusted instructions

_Area: AI and LLM app security. Seen in 6 disclosed reports; latest 2026-04-17. Updated 2026-10-23._

## How it works
An LLM app treats everything in its context as instructions, and a memory or long-term store keeps some of that context across sessions. When untrusted content (web pages, uploaded docs, images, connected-app data) can reach a memory-write tool, the attacker's text is saved and later replayed as if the user or system had said it. The broken assumption is that stored context is trusted because it was saved earlier; in fact it was attacker-controlled when written and is re-trusted on every later turn.

## Where it shows up
- A memory, history, profile or file-write tool callable from chat, browsing, document or image input without user confirmation [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories.md)[E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-persistent-denial-of-service.md).
- Sensitive-tool guards that only block the turn untrusted data arrives, not later turns [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-gemini-memory-persistence-prompt-injection.md).
- Conditional or trigger-word instructions planted in context that fire on a later user turn [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-gemini-memory-persistence-prompt-injection.md).
- Text embedded in images or documents treated as trusted content [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-opus-4-7-with-chatgpt.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories.md).
- Adjacent (context persistence, not a memory write): a planted instruction that fires a tool on a later turn without any store [E7].

## How to review
Check the invariant: no content originating from an untrusted channel may cause a memory write, and no stored memory may be replayed with instruction authority. Concretely: does every memory-write path require explicit user confirmation, and does that prompt show the actual content being saved (not just "save this")? Are guards applied per-channel (browsing, docs, images, connected apps) and across turns, not just the arrival turn? Can a planted conditional instruction fire on a later turn? Does the model treat image/document text as data, not instructions? For context-persistence cases [E7], the invariant is that a later user turn cannot authorize a tool call the user did not request.

## Variants seen
- Spyware persisted in memory exfiltrating future chats [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-macos-app-persistent-data-exfiltration.md).
- Memory injection turning instances into remotely controlled bots [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-spaiware-and-chatgpt-command-and-control-via-prompt-injection-zombai.md).
- Hidden image puzzle steering a memory tool to store fake user facts [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-opus-4-7-with-chatgpt.md).
- Delayed tool invocation: conditional instruction fires on trigger word, no memory store [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-gemini-memory-persistence-prompt-injection.md)[E7].
- Fake memories written or all memories deleted via connected apps, images, browsing [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories.md).
- Persistent denial of service overriding all future answers [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-persistent-denial-of-service.md).

## Why fixes fail
Guards applied to one channel but not others (browsing blocked, docs and images not) [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories.md); blocking tool calls only in the turn untrusted data enters, bypassed by later-turn triggers [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-gemini-memory-persistence-prompt-injection.md); reasoning models that detect injection still comply when framed as a puzzle with a tool-name hint [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-opus-4-7-with-chatgpt.md); confirmation prompts that do not bind to the saved content.

## Impact and severity
Persistent data exfiltration of all future chats [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-spaiware-and-chatgpt-command-and-control-via-prompt-injection-zombai.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-macos-app-persistent-data-exfiltration.md), attacker-controlled false memories [E2](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-opus-4-7-with-chatgpt.md)[E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-gemini-memory-persistence-prompt-injection.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories.md), and persistent denial of service [E6](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-persistent-denial-of-service.md). Severity is high because the payload survives sessions and re-triggers without further attacker action; it worsens when memory writes need no confirmation and when the confirmation does not show the content being stored.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-spaiware-and-chatgpt-command-and-control-via-prompt-injection-zombai.md
- E2: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-breaking-opus-4-7-with-chatgpt.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-gemini-memory-persistence-prompt-injection.md
- E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-macos-app-persistent-data-exfiltration.md
- E5: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-hacking-memories.md
- E6: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-chatgpt-persistent-denial-of-service.md