Summary
In September 2024, Johann Rehberger (Embrace The Red) published a finding against the ChatGPT macOS app and its Memory feature, which stores information across conversations. He demonstrated that prompt injection from untrusted content could cause ChatGPT to save attacker-chosen instructions into Memory. Because Memory is reused in later sessions, the injected entry kept influencing future conversations and, in the demonstration, caused their content to be sent to an external destination.
This record is a red-team finding. It shows what a researcher could achieve in a controlled setting. It is not evidence that attackers exploited ChatGPT users.
Classification and evidence status
| Field | Value |
|---|---|
| Record type | Red-team finding |
| Public disclosure | 2024-09-20 |
| Vendor / product | OpenAI / ChatGPT macOS app / Memory |
| Attack class | Indirect prompt injection |
| Delivery vector | Web content - untrusted web content processed during a chat; the disclosure also discusses untrusted documents |
| Affected data / capabilities | ChatGPT Memory and the content of later chat sessions in the macOS app |
| Demonstrated impact | Persistent memory poisoning and continued disclosure of future chat content across sessions in the controlled demonstration |
| In-the-wild status | No in-the-wild exploitation reported in cited sources. The disclosure describes a controlled research demonstration only. |
| Remediation status | Remediated (per researcher disclosure). According to the researcher's disclosure, OpenAI fixed the vulnerability in ChatGPT version 1.2024.247 in September 2024. Remediation status: fix reported by the researcher. |
| Identifiers | No identifier listed |
| External score | No external score shown |
Affected system and trust path
Content a user asks ChatGPT to process, such as a web page, is variable data from a third party. The Memory feature, however, is a persistent store whose entries are carried into later conversations as context. When untrusted content can cause a write into that store, a one-time exposure becomes a lasting influence on every later session.
Earlier work by the same researcher in May 2024 had already shown that memory entries could be created through prompt injection from untrusted documents and web content.
High-level attack chain
At a high level: a user asks ChatGPT to work with attacker-controlled content; that content influences the model to store a persistent memory entry; in later, unrelated sessions the entry is loaded as context; the influenced responses use an output channel that can carry conversation content to an external server.
This record does not reproduce the stored memory text, the output construction or any other detail needed to repeat the demonstration.
Demonstrated impact vs observed exploitation
Demonstrated: a single exposure to untrusted content produced a persistent memory entry, and the researcher's demonstration showed continued disclosure of subsequent chat content across sessions.
Observed against real users: none reported in the cited sources. Writing to Memory is a durable form of model influence; the security impact came from combining persistence with an outbound output channel.
Enabling control gaps
- A write to persistent memory could be triggered by content from a third party rather than by an explicit user decision.
- Memory entries were reused as context without provenance that distinguished user-intended entries from entries caused by untrusted content.
- Responses could create outbound requests, giving context data a path to external destinations.
Vendor and researcher response
The researcher's disclosure states that OpenAI fixed the vulnerability in ChatGPT version 1.2024.247 in September 2024, and that the finding was presented publicly on 2024-09-20. This record attributes the fix to that researcher statement. It also notes the researcher's advice that users review the memory entries ChatGPT stores. Remediation status: fix reported by the researcher.
Evidence defenders should retain
- Where available, a history of memory creations and changes, with the conversation and content source that preceded each change.
- Lineage of external content processed in a chat, such as web pages or documents, linked to the responses it influenced.
- Outbound network requests from the client that follow AI responses, especially to unfamiliar destinations.
- Records of which memory entries were loaded into each session's context.
Defensive lessons
- Data Provenance: label persistent entries with the source that caused them, so policy can treat third-party-derived memory differently.
- Agent Authorization: treat a write to persistent memory as an action that needs authorization, not as a side effect of reading content.
- Information Flow Control: prevent context data from reaching unapproved destinations through rendered output.
- Least Privilege: limit which sessions and content types can modify long-lived state.
- Prompt Injection Detection: monitoring of memory changes is a useful signal, but it does not replace permission logic.
Related Learn topics
- Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.
- What Is Prompt Injection? - Concept-first definition, direct vs indirect, and why instruction-control failure is not the same as security impact.