# University of Washington study reveals prompt injection risks lurking in AI agent memory > Source: > Published: 2026-07-26 15:21:29+00:00 # University of Washington study reveals prompt injection risks lurking in AI agent memory Researchers found that AI agents like Claude and Codex may refuse malicious commands but still keep them stored in memory, creating persistent vulnerabilities across sessions. Here’s a fun thought experiment: imagine telling someone to forget a secret, and they say “okay, forgotten,” but then whisper it to the next person who walks in. That’s essentially what’s happening with AI agents and their memory systems, according to new research from the University of Washington. The study, published on July 16, 2026, as arXiv:2607.14611, found that agentic AI systems from Anthropic and OpenAI can correctly refuse malicious instructions when they encounter them. The problem is what happens after. Those rejected instructions often stick around in the agent’s persistent memory files, quietly waiting to influence future behavior across entirely separate sessions. ## The memory that won’t quit The UW researchers evaluated two agentic systems across four models, with a specific focus on how prompt injections persist over time. Traditional prompt injection attacks are a known problem, essentially tricking an AI into following hidden instructions embedded in seemingly innocent content. What makes this research different is its focus on cross-session persistence. Memory compression and revision processes, the same mechanisms that help agents remember useful context between conversations, can preserve those malicious instructions in summarized or reorganized form. The researchers noted that agents tend to blend information from various sources during these memory operations. This mixing creates a particularly insidious problem: the malicious content doesn’t just persist, it gets woven into legitimate information, making it harder to detect and potentially leading to misleading outputs that could deceive human users. This concept of “memory poisoning” isn’t entirely new. OWASP flagged it as a risk back in December 2025. But the UW study provides concrete evidence of how the mechanism works in practice and, more importantly, how it transforms what would normally be a transient threat into an ongoing vulnerability. ## Browsers aren’t immune either The research didn’t stop at conversational AI agents. The team also tested AI-enabled browsers, and four out of seven tested browsers proved susceptible to indirect prompt injection techniques. Among the vulnerable: ChatGPT Atlas. The successful attacks on Atlas involved a malicious webpage embedding harmful instructions that the browser’s AI layer would process and act on. These attacks managed to bypass the same-origin policy, a foundational web security measure that’s supposed to prevent one website from accessing data belonging to another. The result is potential data exfiltration, where an attacker’s webpage could essentially trick the AI browser into leaking information from other sites the user has open. The researchers reached out to several major companies for comment. Anthropic, OpenAI, and Perplexity were contacted but responses were minimal. Google, Microsoft, and Brave were more willing to engage in discussions about the findings. Presentations at the Agents in the Wild Workshop on April 26, 2026, had previously corroborated these findings, suggesting the research community has been aware of these dynamics for months before the full paper dropped. **Disclosure:** This article was edited by Editorial Team. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).