What happened
arXiv 2610.28810 ('From Prompt Injection to Persistent Compromise', posted mid-Oct 2026) formalizes 'memory injection' as a general threat model: by injecting into persistent-memory mechanisms it turns a previously single-session prompt injection into cross-session persistent control. The authors demonstrate, empirically across ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash, that all NIST-defined attack goals can be achieved, and that Claude's shared-memory allows compromising multiple users in an organization and exfiltrating user prompts.
Why it matters
As assistants and agents increasingly rely on persistent memory as their primary context layer, memory injection converts the industry's top-ranked LLM vulnerability (prompt injection, LLM01) from a limited, single-session nuisance into a durable compromise that survives conversation resets and can spread organization-wide. This is the mechanism by which a single poisoned memory entry can drive behavior weeks later, making memory stores a first-class attack surface to govern.
Attack vector
Memory injection: an attacker plants malicious instructions into a long-term memory mechanism (personal memory, workspace project, custom skill, organization instruction, or an MCP-connected resource). Because native memory is auto-retrieved and reused in later sessions, the injection propagates across sessions — bypassing the single-session containment of traditional prompt injection and enabling persistent disinformation, harmful output, privacy compromise, or simulated offline unresponsiveness even in fresh sessions.
Affected systems
Commercial LLM-as-a-service platforms with persistent memory: ChatGPT Instant 5.3, Claude Sonnet 4.6, Gemini 3 Flash (and MCP-connected resources)
Mitigation
No vendor patch yet. The authors note nearly half of their derived mitigations remain unimplemented across the evaluated services. Defenders should treat untrusted content that can reach a memory/skill/instruction store as high-authority: scope memory writes, validate/immutable-ize org-level instructions, restrict which sources can populate memory, and monitor for injected behavior that persists across sessions. Attack artifacts/dataset: https://github.com/PedroBarcha/Memory-injection.