Research demo
SpAIware in Windsurf Cascade: prompt injection writes itself into long-term memory for persistent exfiltration
AIR-2025-0111 AIR record · 2025-08-windsurf-spaiware-memory-persistence
From the supporting source
persist instructions into future chat sessionsembracethered.com
The record
Disclosed
2025-08-22
Vendor
Codeium / Windsurf
Product
Windsurf (Cascade agent)
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Privilege escalation, Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — the injection wrote itself into Cascade memory with no approval
Attack surface
Agent memory
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection repo content
Impact type
Data exfiltration, Persistence, Integrity loss, Persistent memory poisoning, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all future chat sessions of an affected Windsurf user
Capability abused
Defense & remediation
Recorded defense
none - create_memory was invoked without user approval
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
none at time of publication; vendor unresponsive for three months
Taxonomy & references
Curator notes
Johann Rehberger, 22 Aug 2025. The Cascade create_memory tool ran without approval, so a single injection in a source file installs instructions that survive across sessions and keep exfiltrating - the writeup states it 'compromises confidentiality, integrity and availability of all future chat conversations'. Disclosed 30 May 2025; vendor largely unresponsive. This is the canonical memory-poisoning demo against a shipped developer product. Also reported as: 'Windsurf SpAIware: persistent prompt injection written into Cascade long-term memory'.
Supporting sources
Cite as
Enkrypt AI. "SpAIware in Windsurf Cascade: prompt injection writes itself into long-term memory for persistent exfiltration". AIR, AIR-2025-0111. https://agentincident.vercel.app/i/AIR-2025-0111/ (accessed 2026-10-19).