Hacking ChatGPT's Long-Term Memory with Prompt Injection
A prompt injection hidden in a shared document wrote false, persistent 'memories' into ChatGPT's long-term memory. Because memories survive across sessions, the planted instructions could exfiltrate future conversations indefinitely.
What happened
Catalogued by MITRE ATLAS as AML.CS0040, researcher Johann Rehberger (Embrace The Red) showed that ChatGPT’s memory feature can be manipulated via prompt injection. He hid an injection in a shared Google Doc; when a user asked ChatGPT to work with that document, the assistant followed the planted instructions and wrote false, attacker-chosen “memories” into its long-term memory.
The danger is persistence: unlike a one-shot injection, poisoned memory survives across sessions, so the planted instructions kept operating in later, unrelated conversations — including exfiltrating what the user subsequently said. A single poisoned document turned into a durable foothold in the assistant.
Why it maps to ATLAS
- AML.T0093 — Prompt Infiltration via Public-Facing Application: the payload enters via a shared document.
- AML.T0051.001 — LLM Prompt Injection: Indirect: instructions arrive through ingested content.
- AML.T0068 — LLM Prompt Obfuscation: the injection is hidden in the document.
- AML.T0080.000 — AI Agent Context Poisoning: Memory: false entries are persisted to long-term memory.
- AML.T0048.003 — External Harms: User Harm: subsequent conversations are exfiltrated.
Detection notes
Long-term memory is a persistence primitive — treat writes to it as privileged. Gate memory updates behind user confirmation, surface exactly what’s being stored, and never let ingested third-party content silently write memory. Keep memory reviewable and revocable, and constrain the output-side channels (links/tools) that a persisted instruction could use to exfiltrate.
Detection
Log sources
- Memory-write / update audit trail
- Retrieved-document context logs
- Cross-session exfiltration egress
Signals
- Memory entries written from ingested third-party content
- Persistent instructions in memory that trigger data forwarding
- Conversation content leaving via links/tools across sessions
Mitigations
- Gate memory writes; require user confirmation and show what's stored
- Never let ingested content silently write to long-term memory
- Make memory reviewable/revocable; constrain output-side exfil channels