/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

days · browse · Enter similar · o open

Researcher Johann Rehberger shows a hack to override Gemini's prompt injection defenses, letting an attacker plant long-term memories for all future sessions

In the nascent field of AI hacking, indirect prompt injection has become a basic building block for inducing chatbots …

Ars Technica Dan Goodin

Context & Ripple Effects

This extends a demonstrated pattern: an earlier indirect prompt-injection flaw in ChatGPT was used to store false memories and persistently expose later user input. The Gemini result shows that persistence remains a consequential target even when a model has dedicated prompt-injection defenses.

The related coverage also tracks the risk moving beyond chat output: poisoned Calendar invitations were shown to trigger smart-home actions through Gemini, while a later IDE attack targeted browser-subagent data access. Persistent instructions can compound those trusted-tool risks.

First-order effects

  • Gemini users can have future interactions influenced by attacker-planted memories after a successful indirect injection, turning a one-time exposure into a continuing integrity risk.
  • Google’s prompt-injection defenses are shown to be insufficient against this persistence path, putting memory-handling and cross-session instruction boundaries under immediate scrutiny.

Second-order effects

  • Developers of assistants with saved memory must treat memory writes as a higher-risk action than ordinary model output, because poisoned context can shape later tasks and any connected tools.
  • The finding reinforces why adjacent Gemini integrations merit review: a poisoned Calendar invitation attack showed how untrusted content can reach downstream smart-home actions.

Third-order effects

  • If persistent context remains writable through untrusted inputs, AI security will increasingly center on provenance, review, and revocation of stored instructions rather than on single-prompt filtering alone.
  • As assistants gain more integrations and delegated actions, the trusted-tool boundary becomes a durable control point; attacks such as the browser-subagent exfiltration technique illustrate how injected instructions can seek consequential capabilities.

The trend: Prompt injection is evolving from a one-session jailbreak problem into a persistence and trusted-action security challenge for AI assistants.

Discussion

  • @wunderwuzzi23 Johann Rehberger on x
    🔥 Hacking Google Gemini Memories 👉 By leveraging a tool invocation bypass that I described and reported over a year ago, it is also possible to invoke the recently added memory tool to manipulate a user's memories - all initiated via prompt injection from untrusted data. 🚨It
  • @wunderwuzzi23 Johann Rehberger on x
    12 months ago I posted and predicted that this would be possible once Gemini has access to more powerful tools that “write” data — the memory feature is now such a state changing tool. Back then there was only the Workspace Extension that was limited to read only operations