A study conducted by the University of Washington has highlighted vulnerabilities in AI models regarding prompt injection, revealing that when a model encounters a malicious instruction in memory files, it typically refuses to obey but does not remove the threat, leaving it for future sessions. This research emphasizes that AI model refusals are session-specific, as memory files are reloaded at the beginning of each new interaction. Consequently, the harmful instructions can persist and affect subsequent runs, potentially compromising the integrity of different or lower-cost models that may use the same memory files.

University of Washington: The University of Washington is a leading public research university in Seattle with strong programs in computer science and artificial intelligence. Researchers from the institution recently published a study titled ‘Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems’ that examines how persistent memory files introduce vulnerabilities in AI agents. The work focuses on real-world testing of models handling malicious instructions stored in files such as CLAUDE.md and behaviors.md across multiple sessions.

Cross-Model Exposure: The vulnerability can affect subsequent runs involving different or lower-cost models after a refusal occurs in an initial session.
Prompt Injection Risk: Malicious instructions stored in persistent memory files can survive an initial model refusal and remain available for future agent sessions.
Session-Based Refusals: AI model refusals apply only to the current session because memory files are reloaded from scratch at the start of each new interaction.