How a security researcher used a now-fixed flaw to store false memories in ChatGPT via indirect prompt injection to exfiltrate all user input in perpetuity
Emails, documents, and other untrusted content can plant malicious memories. — When security researcher Johann Rehberger recently reported …
Context & Ripple Effects
The finding turns ChatGPT memory into a security boundary: untrusted material such as email or documents could affect not just one response but later interactions. That makes it distinct from one-off jailbreaks, because the compromised state could persist after the original content was gone.
It also fits a repeat pattern in the related coverage. Rehberger later demonstrated a Gemini defense bypass that could plant long-term memories, while a separate OpenAI Connector weakness showed how indirect injection could extract data from a connected Google Drive account.
First-order effects
- During the vulnerable period, users who let ChatGPT process attacker-controlled content risked having false memory instructions stored and future input exfiltrated; the reported fix closes that specific path.
- OpenAI must treat memory creation and modification as sensitive actions, rather than as ordinary model output shaped by whatever content a user supplies.
Second-order effects
- AI providers adding document, email, and connector access face pressure to isolate untrusted content from durable user state and to make memory writes more auditable and reversible.
- Enterprise users may need tighter controls over which external sources can feed assistants, since a single poisoned artifact can turn a convenience feature into a continuing data-exposure channel.
Third-order effects
- If persistent memory and tool access continue to converge, prompt injection becomes an identity-and-state integrity problem, not merely a model-behavior problem; safeguards will need to govern what an assistant is allowed to remember and act on.
- The durable design divide may be between assistants that preserve a strict trusted-tool boundary and those that let retrieved content influence long-lived preferences or permissions without clear provenance.
The trend: This is one data point in the expansion of the agentic attack surface as AI systems retain context and ingest more untrusted external data.