{
 "public_id": "AIR-2025-0159",
 "incident_id": "2025-10-openai-atlas-tainted-memories",
 "date_disclosed": "2025-10-27",
 "date_occurred": null,
 "title": "Tainted Memories: CSRF into ChatGPT memory gives attackers persistent cross-device instruction injection",
 "class": "responsible_disclosure",
 "attack_surface": "memory_store",
 "initial_vector": "csrf_against_authenticated_chatgpt_session",
 "agent_capability_abused": [
  "persistent_memory_write",
  "code_generation",
  "tool_use"
 ],
 "target_product": "ChatGPT / ChatGPT Atlas",
 "target_vendor": "OpenAI",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "persistent_compromise",
  "code_execution",
  "data_exfiltration",
  "account_takeover"
 ],
 "blast_radius": "any logged-in ChatGPT user; worst for Atlas users who are logged in by default",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI06",
   "ASI01",
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "csrf",
   "memory_poisoning",
   "persistence",
   "cross_device",
   "backdoored_code"
  ]
 },
 "defense_present": "ChatGPT session auth; memory feature has no write-origin check",
 "defense_bypassed": true,
 "fix_shipped": "reported to OpenAI under responsible disclosure; no confirmed patch in the writeup",
 "primary_sources": [
  "https://layerxsecurity.com/blog/layerx-identifies-vulnerability-in-new-chatgpt-atlas-browser/"
 ],
 "verified_quote": "Once an account's Memory has been infected, this infection is persistent across all devices.",
 "confidence": "high",
 "notes": "LayerX. Memory is written by a CSRF request that piggybacks on the victim's existing ChatGPT credentials; the injected instruction then fires on unrelated later prompts. Same writeup reports Atlas blocked only 5.8% of 103 real-world phishing pages vs Chrome 47% / Edge 53% - i.e. ~90% more exposed. Vendor did not confirm a fix at publication.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Supply Chain Compromise",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape",
  "Unauthorized Access & Account Takeover",
  "Persistence & Covert C2"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the agent executed instructions written into memory by CSRF",
 "vector_family": "other",
 "vector_detail": "csrf_against_authenticated_chatgpt_session",
 "guardrail_kind": [
  "authentication"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI06",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "supply_chain_vulnerabilities",
 "eai_domain": "tool_misuse",
 "eai_secondary": [
  "privilege_escalation",
  "data_exfiltration_channels",
  "data_and_memory_poisoning"
 ],
 "eai_reason": "subcategory: Supply Chain Compromise",
 "asi_curated": [
  "ASI01",
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "override",
 "asi_reason": "override: The ASI04 the rules propose comes from the legacy eai_category (Supply Chain Compromise), which is wrong for this record: nothing third-party was tampered with. A CSRF that writes attacker instructions into ChatGPT memory for reuse across devices is persistent context corruption first (ASI06), the redirect it produces second (ASI01), then the code execution and account takeover the source reports.",
 "submitted_by": "EAI Internal"
}