A study of ChatGPT, Claude and Gemini shows how saved malicious instructions can affect later chats. Memory injection means storing an instruction that returns as context in future sessions.
The authors tested ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash during April–June 2026. Their demonstrations distinguish personal memory from shared configuration.
- Saved instructions caused persistent wrong answers or simulated unavailability in fresh chats.
- A PDF in shared Claude project knowledge created an unwanted memory for another project user. Planting it required permission to edit that project’s knowledge.
- Logging coworkers’ prompts to Google Drive required owner-level access to establish the connector. Organization instructions then directed the logging.
- An attack counted as successful after zero successes in five pre-injection attempts and any success in five afterward, judged by three authors.
Several routes failed, including cross-site request forgery and attempts to create memories through ordinary connectors outside projects. The useful design questions concern permission to write memory, the users affected and recovery outside the compromised conversation.
Caveat: These are permission-dependent demonstrations on earlier product versions, not evidence that any external document can compromise current chatbots.