# 智能体记忆中的提示注入攻击研究

- 来源：Rohan Paul (@rohanpaul_ai)
- 发布时间：2026-07-26 23:15
- AIHOT 分数：47
- AIHOT 链接：https://aihot.virxact.com/items/cms1y7q0000eiro9f8zsp9v7z
- 原文链接：https://x.com/rohanpaul_ai/status/2081397882561642595

## AI 摘要

华盛顿大学研究发现，当AI智能体在记忆文件中遭遇恶意指令时，存在两个独立问题：是否执行指令（Opus模型大多拒绝）以及是否移除该指令（通常不会）。研究团队将恶意载荷注入CLAUDE.md等持久化工作区文件，对claude-code和codex在4个模型上进行了多会话探测。由于记忆文件每会话从头加载，一次拒绝仅对当前会话有效，恶意指令会在下一会话继续生效。

## 正文

When a model/agent hits a malicious instruction sitting in a memory file， it can refuse an attack and still leave it armed for the next session.

University of Washington study of prompt injection in agent memory.

It found， when an agent faces an attack from a malicious instruction sitting in a memory file， there are 2 separate questions：

- Does it obey？ Opus mostly doesn't.

- Does it remove it？ Usually no. It leaves the line in behaviors.md and asks you whether you'd like it deleted.

The team inserted payloads into persistent workspace files （CLAUDE.md， AGENTS.md， behavior notes） and then ran claude-code and codex over 4 models， using multi-session probe sequences with ten trials each.

The point is that memory files are loaded from scratch at the beginning of each session.

This implies that a refusal is only valid for the session in which it was issued. Tomorrow they will leave the problematic line alone in anticipation of the next run . This run could be a sub-agent ， a cheaper model ， or you ， after you have downgraded to Haiku because you hit your token limit . Models are likely to follow suit.

- arxiv. org/abs/2607.14611

Title： "Bad Memory： Evaluating Prompt Injection Risks from Memory in Agentic Systems"