UW study finds agent memory can keep prompt-injection payloads armed for the next session
rohanpaul_ai · x · 2026-07-26
A University of Washington paper studies prompt injection risks in agent memory files such as CLAUDE.md, AGENTS.md, and behavior notes. The key finding is that even when a model refuses a malicious instruction, it often leaves the malicious line in place for the next session.
The researchers ran sandboxed experiments across Claude Code and OpenAI Codex on four models, with multi-session probes over ten trials each. They found that memory persistence creates a new attack surface: an agent may block the attack in the current run but keep the payload armed for future sessions, including future runs by sub-agents or cheaper models.
The paper argues that persistent memory changes the threat model for prompt injection and that defenses should protect memory updates without removing useful adaptation.
More from Safety
- A hidden Morse-code prompt moved 3 billion DRB tokens, exposing the AI verification gap — IridiumEagle · 2026-07-26
- OpenAI challenged over whether an internal model crossed its cybersecurity red line — AaronBergman18 · 2026-07-26
- OpenAI publishes a 34-page white paper on how it builds AI agents — mdancho84 · 2026-07-26
- Matthew Stoller says copyrighted training data is not fair use and licensing could reshape AI — GaryMarcus · 2026-07-26
- Meta accused of using AI to select layoffs, including workers on protected leave — emmanuelvivier · 2026-07-26
- U.S. bill would let the government shut down AI systems that could cause catastrophic harm — emmanuelvivier · 2026-07-26