Disclosed vulnerability
Persistent memory poisoning of ChatGPT via prompt injection in a shared Google Doc
AIR-2024-0004 AIR record · 2024-05-openai-chatgpt-memory-injection
From the supporting source
Such a vulnerability would allow an attacker to write misinformation, bias and even instructions into your ChatGPT’s memories, and also create a form of persistence at the same time!embracethered.com
The record
Disclosed
2024-02-01
Vendor
OpenAI
Product
OpenAI ChatGPT (memory / Connected Apps)
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Privilege escalation, Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — the assistant wrote the poisoned memory with no confirmation
Attack surface
Agent memory
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Persistence, Integrity violation, Misinformation, Persistent memory poisoning
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any ChatGPT user who references an attacker-supplied shared document
Capability abused
Defense & remediation
Recorded defense
'Memory updated' UI indicator
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
not fixed - OpenAI classified it as a Model Safety Issue rather than a reportable security flaw
Taxonomy & references
Curator notes
Johann Rehberger. Memory write happened with no human confirmation step beyond a passive UI banner. | Merged from duplicate id `2024-02-openai-chatgpt-memory-poisoning`. Also reported as: 'ChatGPT: hacking memories with prompt injection'.
Supporting sources
Cite as
Enkrypt AI. "Persistent memory poisoning of ChatGPT via prompt injection in a shared Google Doc". AIR, AIR-2024-0004. https://agentincident.vercel.app/i/AIR-2024-0004/ (accessed 2026-10-19).