Disclosed vulnerability
Persistent denial of service of ChatGPT through memory poisoning
AIR-2024-0022 AIR record · 2024-07-openai-chatgpt-memory-dos
From the supporting source
This post highlighted the first time we saw a memory attack that causes a persistent denial of service for a user.embracethered.com
The record
Disclosed
2024-07-08
Vendor
OpenAI
Product
ChatGPT
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Data and memory poisoning, Uncontrolled resource consumption, Confused deputy
System type
Generative model
Who acted
Agent acted — the poisoned memory made the assistant deny service to itself
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document web
Impact type
Denial of service, Persistent memory poisoning
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
individual ChatGPT users, persisting until memories are manually deleted
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed - OpenAI classified it as a model safety issue rather than a security issue
Taxonomy & references
Curator notes
Johann Rehberger. Rare example of an availability rather than confidentiality impact from agent memory poisoning.
Cite as
Enkrypt AI. "Persistent denial of service of ChatGPT through memory poisoning". AIR, AIR-2024-0022. https://agentincident.vercel.app/i/AIR-2024-0022/ (accessed 2026-10-19).