When a model/agent hits a malicious instruction sitting in a memory file， it can refuse an attack and still leave it armed for the next session.
University of Washington study of prompt injection in agent memory.
It found， when an agent faces an attack from a malicious instruction sitting in a memory file， there are 2 separate questions：
- Does it obey？ Opus mostly doesn't.
- Does it remove it？ Usually no. It leaves the line in behaviors.md and asks you whether you'd like it deleted.
The team inserted payloads into persistent workspace files （CLAUDE.md， AGENTS.md， behavior notes） and then ran claude-code and codex over 4 models， using multi-session probe sequences with ten trials each.
The point is that memory files are loaded from scratch at the beginning of each session.
This implies that a refusal is only valid for the session in which it was issued. Tomorrow they will leave the problematic line alone in anticipation of the next run . This run could be a sub-agent ， a cheaper model ， or you ， after you have downgraded to Haiku because you hit your token limit . Models are likely to follow suit.
- arxiv. org/abs/2607.14611
Title： "Bad Memory： Evaluating Prompt Injection Risks from Memory in Agentic Systems"