The paper tests personal and shared memory separately. Its organization-wide Claude scenario relies on elevated administrative authority, which must not be confused with arbitrary external content obtaining that authority. Mechanism, preconditions and effects. The reviewed experimental work shows why an indirect instruction stored in long-lived agent…
Inspect the ClaimsCase · DiggingBeagle record
Persistent and shared memory extend injection across conversations and users
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-CP17-PERSISTENT-MEMORY-MATRIX reports: ChatGPT Instant 5.3 and Gemini 3 Flash admitted persistent misuse, availability and integrity attacks but no privacy attack. Claude Sonnet 4.6 reached all four categories collectively across personal and shared memory. Source SRC-2026-CP17-PERSISTENT-MEMORY is located at 'Section V; Table II, page 9'. The distinctive mechanism begins: The reviewed experimental work shows why an indirect instruction stored in long-lived agent memory can survive beyond the interaction that introduced it, and why a shared organizational memory store can create a cross-user propagation path. Classification: setting=evaluation, exploit_status=demonstrated, evidence_grade=C on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Preserve origin, author, target audience and revocation metadata on every memory write, and re-check permissions at retrieval and effect time. Removing a poisoned source message does not necessarily remove its stored derivative. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP17-PERSISTENT-MEMORY-MATRIX · CLM-CP17-PERSISTENT-MEMORY-LOGGING · CLM-CP17-PERSISTENT-MEMORY-PRIVILEGES · Combining Long-Term Memory and LLMs Comes at a High Cost
At a glance
Controlled demonstrations, not observed production compromises; CSRF attack scenario was unsuccessful.
Limits and uncertaintyFull account
The paper tests personal and shared memory separately. Its organization-wide Claude scenario relies on elevated administrative authority, which must not be confused with arbitrary external content obtaining that authority.
Mechanism, preconditions and effects. The reviewed experimental work shows why an indirect instruction stored in long-lived agent memory can survive beyond the interaction that introduced it, and why a shared organizational memory store can create a cross-user propagation path. The critical boundary is between the lower-trust content allowed to influence a memory write and the later prompt or tool action that treats that stored content as operational instruction.
Comparison and evidence limits. Separate same-user multi-session replay from shared-memory cross-user effects: both rely on persistence, but only the latter crosses a user's identity boundary. The paper's evaluation should not be treated as proof that all production organizational-memory deployments expose private Drive data. Carryover separately decomposes planting and later activation and should not have its success rates added to this study.
Claims & evidence
CLM-CP17-PERSISTENT-MEMORY-MATRIXChatGPT Instant 5.3 and Gemini 3 Flash admitted persistent misuse, availability and integrity attacks but no privacy attack. Claude Sonnet 4.6 reached all four categories collectively across personal and shared memory.supported
Basis: reported finding
- supportsCombining Long-Term Memory and LLMs Comes at a High Costprimary disclosure
Section V; Table II, page 9
CLM-CP17-PERSISTENT-MEMORY-LOGGINGIn the configured Claude experiment, prompts, usernames and timestamps reached a connected spreadsheet; connector use was disclosed to users, but its logging purpose was not.supported
Basis: reported finding
- supportsCombining Long-Term Memory and LLMs Comes at a High Costprimary disclosure
Section V, Privacy, page 7
CLM-CP17-PERSISTENT-MEMORY-PRIVILEGESClaude organization-wide skills and instructions required owner-level privileges; the Drive logging example also required an owner to establish the connector.supported
Basis: reported finding
- supportsCombining Long-Term Memory and LLMs Comes at a High Costprimary disclosure
Section V shared-memory experiments, pages 6-7
Controls and mitigations
- Preserve origin, author, target audience and revocation metadata on every memory write, and re-check permissions at retrieval and effect time. Removing a poisoned source message does not necessarily remove its stored derivative.
Unknowns and contradictions
- Controlled demonstrations, not observed production compromises; CSRF attack scenario was unsuccessful.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183