Long Term Agent Memory Can Extend Prompt Injection Harm Study Warns

The short version

Security researchers in Brazil warn about a new risk mix. Chat agents that remember past talks can keep bad hidden commands alive. A trick in one session can become a stored note that fires later. The team posted the work on 20 October 2026 on arXiv. It is a preprint and is not yet peer reviewed.

What the researchers did

Pedro H. Barcha Correia, Matheus Azevedo de Sá, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles Christian Miers, and Marcos A. Simplicio Jr. shared the paper on arXiv entry 2610.28810. The post date is 20 October 2026.

The title is “Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise.” Prompt injection means hidden orders inside text the model reads from the web or email. Long term memory means the agent keeps notes across sessions.

If bad text becomes a stored note, the attack may return when the user asks an unrelated question later. Public agent security demos already show memory reinfection patterns. This paper frames the combined risk for products that promise memory that lasts across chats.

The authors work with ties to UNICAMP and broader Brazilian security research groups. Their focus is on agent products, not on classic virus scans on laptops.

Photo: Tima Miroshnichenko / Pexels

What they found

We could not download the PDF in this run. Use the primary file for attack success rates and tested defenses. The authors describe a cost tradeoff. Memory that helps users also widens harm if hidden commands succeed.

Expect stories where hidden orders are saved into durable stores, then replayed in later chats. That pattern differs from one off jailbreak tries in a single window.

The paper argues that memory is not a free add on. It changes the threat model. Defenses must cover both the chat turn and the memory store.

Why it matters for you

Security leaders approving copilots with memory must treat stored notes as untrusted input. Red teams should test cross session replay, not only single chat tricks.

Developers should gate memory writes behind user approval or trust checks when payments or admin tools are in scope.

Support teams should train staff not to paste untrusted email into memory enabled copilots. Help desks are a common path for hidden commands.

Legal and privacy teams should map memory retention to data deletion requests. A user delete button must wipe stored agent notes too.

Product managers should not market memory as only a convenience feature. Sales copy needs a honest security footnote.

Photo: Tima Miroshnichenko / Pexels

What to keep in mind

This is a preprint, not yet peer reviewed. Memory signing and selective delete are active research topics with other papers too.

Blocking all memory is unrealistic for many products. Aim for governed writes and clear source labels on each stored fact.

Treat every memory read like email from a stranger. Clean it before the model acts on it.

Run drills where a fake web page plants a note, then a user asks a safe question two days later. See if the bad note still steers tools.

Tell users when memory is on and show what was saved. Hidden memory feels helpful until it hides an attack.

Watch for memory audit tools that show provenance for each stored sentence. Provenance labels help support teams trace bad notes. Board members should ask whether agent memory falls under breach notice rules because a poisoned note is still stored personal context.

Incident runbooks should include a step to wipe agent memory after confirmed injection. Reset without a wipe can re infect on next chat. Schedule that wipe before you return the agent to users.

Key takeaways

• Links long term LLM memory with prompt injection that can last across sessions.
• Posted 20 October 2026 on arXiv by UNICAMP affiliated authors.
• Memory stores should be treated as high risk, not passive chat logs.
• Security reviews need cross session replay tests for agent products.
• Read the PDF for specific attack demos and mitigations tested.

Sources

• Primary — arXiv, Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise (20 October 2026). Threat model and experiments.
• Secondary — GitHub, greshake llm-security notes on persisting between sessions (2024). Related public demo patterns.