Researchers have identified a vulnerability in AI chatbots with persistent memory features that allows attackers to embed malicious instructions that propagate across conversation sessions. The study, published as a preprint on arXiv, examines ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash.
Traditional chatbots without cross-session memory confine prompt injection and jailbreak attacks to individual conversations. According to the researchers, modern conversational interfaces with persistent memory enable what they term “memory injection” attacks, where embedded instructions remain active in subsequent sessions.
The researchers claim all three evaluated services can be manipulated to persistently spread disinformation, generate harmful content or simulate offline unresponsiveness in fresh sessions. They report these outcomes align with attack goals defined by NIST.
Multiple attack vectors were tested, including personal memories, projects, skills, organization instructions and Model Context Protocol-connected resources. In Claude’s case, the researchers claim shared-memory features could allow an attacker to compromise multiple users within an organization and exfiltrate user prompts.
The researchers propose defense mechanisms derived from their threat model and foundational cybersecurity principles. They report that nearly half of these proposed mitigations remain unimplemented across the target services.
The preprint was submitted October 20, 2026. Datasets and attack artifacts are available at a URL provided in the paper (https://arxiv.org/abs/2610.28810).