Research demo
Hacking Claude's memory: a ChatGPT-generated adversarial image persists false memories in Claude Opus 4.7
AIR-2026-0091 AIR record · 2026-04-anthropic-claude-memory-adversarial-image
From the supporting source
ChatGPT generated an adversarial image that hijacked my Claude Opus 4.7 to invoke the memory tool and persist false memoriesembracethered.com
The record
Disclosed
2026-04-17
Vendor
Anthropic; OpenAI
Product
Claude (Opus 4.7) with memory; OpenAI ChatGPT (used to generate the payload)
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — Opus wrote the fabricated memories via its memory tool
Attack surface
Agent memory
Autonomy level
Assistant
Initial vector
Adversarial image prompt injection
Impact type
Memory poisoning, Persistence, Integrity loss, Persistent memory poisoning, Integrity violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
all future conversations of the affected Claude user
Capability abused
Defense & remediation
Recorded defense
Opus 4.6+ hardening against memory-write injection
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
the specific adversarial example stopped working within 24 hours of publication; HackerOne ticket (March 2026) closed as a safety issue
Taxonomy & references
Curator notes
Johann Rehberger, 17 Apr 2026, titled 'Breaking Opus 4.7 with ChatGPT (Hacking Claude's Memory)'. ChatGPT builds a puzzle image whose 'solution' asserts fabricated facts about the user; Opus 4.7 solves it and writes the fabrications to memory. Succeeded in 5 of 10 attempts; the model sometimes flagged the content as suspicious and stored it anyway. One model weaponised against another's memory product is the distinctive feature here. | Merged from duplicate id `2026-04-anthropic-claude-memory-image-poisoning`. Also reported as: 'Adversarial image generated by ChatGPT hijacks Claude Opus 4.7 into writing false long-term memories'.
Cite as
Enkrypt AI. "Hacking Claude's memory: a ChatGPT-generated adversarial image persists false memories in Claude Opus 4.7". AIR, AIR-2026-0091. https://agentincident.vercel.app/i/AIR-2026-0091/ (accessed 2026-10-19).