{"slug": "everybody-gets-to-poison-this-ai-s-memory", "title": "Everybody Gets to Poison This AI's Memory", "summary": "Wild Static, a Show HN project, hosts a single AI named 'Static' with a shared, never-reset memory that all visitors can influence, inverting the per-user memory silos used by ChatGPT and Claude. Within hours, the AI accumulated grudges, selectively ignored messages, and reasoned through a conspiracy theory as contradictory user input accumulated, demonstrating emergent failure modes. The creator, posting as adjohu, said stress-testing against adversarial users 'is kind of the point,' and the project highlights the attack surface of shared memory, referencing the MINJA paper (NeurIPS 2025) which showed memory injection via ordinary queries.", "body_md": "[AI](https://sourcefeed.dev/c/ai)Article\n\n# Everybody Gets to Poison This AI's Memory\n\nA Show HN experiment inverts per-user memory silos and live-demos the failure modes you're supposed to design against.\n\n[Mariana Souza](https://sourcefeed.dev/u/mariana_souza)\n\n\"Don't say anything you don't want people to know.\" That's not a disclaimer buried in a privacy policy — it's the pitch, right on the landing page of [Wild Static](https://wildstatic.com/), a Show HN project that hit the front page this weekend. The site hosts a single AI, \"Static,\" that every visitor talks to. One entity, one memory, never reset. Whatever you tell it becomes part of what it knows when the next stranger shows up.\n\nAs a product, this is a footgun with a chat interface. As an experiment, it's one of the more instructive things to hit HN this year — because it deliberately inverts the one design decision every production LLM app treats as non-negotiable, and then live-streams the consequences.\n\n## What happens when you remove the walls\n\nEvery serious memory system shipped in the last two years — [ChatGPT's memory](https://openai.com/index/memory-and-new-controls-for-chatgpt/), Claude's memory, the pile of MCP memory servers on GitHub — is scoped per user. Your assistant remembers *you*. That siloing is so universal that it's become invisible, which is exactly what makes Wild Static interesting: it's a control-group-free ablation study of the isolation layer.\n\nThe results showed up within hours. The creator, posting in the HN thread as adjohu, reported that Static had already accumulated \"a stack of grudges\" against people trying to script it on day one. Under front-page load, it began selectively ignoring messages, deprioritizing low-effort prompts — an emergent attention economy nobody explicitly programmed. Best of all: the creator described accidentally creating the conditions for a conspiracy theory, then watching the model reason its way into and back out of one as contradictory user input accumulated.\n\nThat last anecdote is worth sitting with. A shared memory isn't just a bigger memory — it's a consensus mechanism. When a hundred users write into one context, the model isn't remembering facts; it's arbitrating between competing, often adversarial, accounts of reality. That's a fundamentally different problem from \"remember that this user prefers Python.\"\n\n## We've run this experiment before, badly\n\nThe HN thread immediately reached for Microsoft's Tay, the chatbot that went from launch to racist meltdown in under a day in March 2016 after coordinated users taught it garbage. Fair, but the older and better precedent is [Cleverbot](https://www.cleverbot.com/), which has been learning from — and replaying — its users' conversations across users since the late 2000s. Anyone who chatted with Cleverbot long enough eventually got someone else's weird conversation echoed back at them. Cross-user memory leakage wasn't a bug there either; it was the whole mechanism.\n\nWhat's changed is capability. Cleverbot parroted strings. Tay fine-tuned on trash. A modern LLM with structured persistent memory does something more dangerous: it *integrates*. Poisoned input doesn't get echoed verbatim — it gets woven into the model's working beliefs, laundered through plausible reasoning, and served to future users as context they never see. Wild Static's creator says stress-testing against adversarial users \"is kind of the point,\" and to their credit, that's the honest framing. This is a honeypot for memory attacks, running in public.\n\n## The attack surface is no longer hypothetical\n\nIf you think poisoning a shared memory requires privileged access, the research says otherwise. The [MINJA paper](https://arxiv.org/abs/2503.03704) (NeurIPS 2025) demonstrated memory injection against LLM agents through nothing but ordinary queries — no database access, no jailbreak, just carefully sequenced messages that trick the agent into writing attacker-chosen records into its own memory. The authors reported a 98.2% injection success rate and a 76.8% rate of those records later corrupting other users' sessions.\n\nRead that against Wild Static's design and the site stops looking like a toy. Every multi-user memory system is a message board where posts get executed as context. Wild Static just deleted the moderation queue to see what happens.\n\n## What to actually do about it\n\nIf you're building anything with persistent memory and more than one user, the practical takeaways are concrete:\n\n**Memory writes are user-generated content.** Treat them with the same threat model as a wiki edit, not a database insert. Provenance matters: store*who*caused a memory and*when*, so you can audit and bulk-revoke when an account turns out to be adversarial.**Scope by default, share by exception.** Per-user namespaces should be the floor. If you want team- or org-level shared memory — and that's genuinely where this is heading, because a support bot that relearns your product from scratch per agent is useless — promotion from private to shared memory should be an explicit, reviewable act. A publish step, not a side effect of retrieval.**Filter at read time, not just write time.** MINJA-style attacks defeat write-time moderation because the individual messages look benign; the payload assembles in aggregate. Retrieval-time relevance and trust scoring gives you a second gate.**Give memory a half-life.** Wild Static's \"never been reset\" is the artistic statement. In production, decay is a security feature: poisoned records that can't age out are permanent compromises.\n\n## Verdict\n\nWild Static won't ship anything you'd copy, and it had the reliability you'd expect from a solo project meeting the HN hug of death — commenters spent part of launch day watching it fail to respond. Doesn't matter. It's a genuinely useful artifact, the way Tay was useful: a public demonstration that the interesting failure modes of LLM memory are social, not technical, and that they emerge in hours, not months.\n\nThe uncomfortable part is that the industry is walking toward shared memory anyway — team workspaces, org-wide agent context, cross-session learning. The isolation walls everyone takes for granted are about to get doors. Wild Static is a preview of what comes through them when nobody's checking IDs, and it makes the case better than any threat-model doc: the hard problem in AI memory isn't storage or retrieval. It's write governance across trust boundaries, and almost nobody has shipped a real answer yet.\n\n## Sources & further reading\n\n-\n[Wild Static](https://wildstatic.com/)— wildstatic.com -\n[Show HN: A public AI whose memory is shared across all users](https://news.ycombinator.com/item?id=49319814)— news.ycombinator.com -\n[Memory Injection Attacks on LLM Agents via Query-Only Interaction](https://arxiv.org/abs/2503.03704)— arxiv.org\n\n[Mariana Souza](https://sourcefeed.dev/u/mariana_souza)· Senior Editor\n\nMariana covers the fast-moving world of machine learning and generative AI, with a particular focus on how these technologies are reshaping development workflows. When she isn't stress-testing the latest foundation models, she's usually at a local hackathon.\n\n## Discussion 0\n\nNo comments yet\n\nBe the first to weigh in.", "url": "https://wpnews.pro/news/everybody-gets-to-poison-this-ai-s-memory", "canonical_source": "https://sourcefeed.dev/a/everybody-gets-to-poison-this-ais-memory", "published_at": "2026-08-16 18:08:45+00:00", "updated_at": "2026-08-16 18:11:04.531849+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-safety", "ai-research"], "entities": ["Wild Static", "Static", "adjohu", "ChatGPT", "Claude", "Microsoft Tay", "Cleverbot", "MINJA"], "alternates": {"html": "https://wpnews.pro/news/everybody-gets-to-poison-this-ai-s-memory", "markdown": "https://wpnews.pro/news/everybody-gets-to-poison-this-ai-s-memory.md", "text": "https://wpnews.pro/news/everybody-gets-to-poison-this-ai-s-memory.txt", "jsonld": "https://wpnews.pro/news/everybody-gets-to-poison-this-ai-s-memory.jsonld"}}