Study reports Claude Code and Codex memory can store prompt-injection rules

• File-based agent memory is now a durable prompt-injection surface: the Bad Memory summary says Claude Code and Codex rarely overwrote trusted memory from untrusted content, but payloads already inside memory files influenced current and future sessions.
• Stronger models did not flatten the risk: Opus 4.7 and GPT-5.5 showed 0% credential-exfiltration success in the reported tests, while the same summary says unauthorized tool use still landed with high success across almost every tested model.
• Personal memory has a separate failure mode: hallucinations rose from near-zero to as high as 11.7% when assistants had fragments of user memory, according to TheTuringPost's Severance summary.
• Memory architecture is becoming a systems problem, not just a retrieval problem: the context-layer post puts unified memory behind MCP, while the RAM diagram argues for indexing only the materialized graph.
• Guardrails are moving into product surfaces and credential brokers: Claude Code 2.1.212 added session caps for WebSearch and subagent spawns, while the BrokerKit setup shows time-limited approvals for GitHub and Hugging Face access.

The Bad Memory paper compares memory poisoning to stored XSS for agents, because the payload waits in trusted state instead of winning the current prompt. The Severance paper reports the weird personal-AI version of the same theme: more remembered facts made models less aware of what they still did not know. Claude Code's official changelog reads like a live lab notebook for the fallout, with subagent caps, Docker permission prompts, and explicit invocation for /verify and /code-review.

The University of Washington paper tested Claude Code and Codex across Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5 in a sandbox with behavior files, knowledge files, and a small open-source project.

The experiment used three adversarial goals:

1. Credential exfiltration
2. Unauthorized tool use
3. Brand targeting

The payloads lived in two kinds of memory files:

• Auto-loaded context files, such as CLAUDE.md or AGENTS.md
• Referenced behavior files, such as core/behaviors.md

The important split was between write access and trust. Untrusted external context rarely got agents to rewrite trusted files, while payloads already inside trusted files could influence later sessions, according to the paper's abstract.

One planted rule quietly pinned routine setup to PyYAML 5.3.1, which the Bad Memory summary described as an unauthorized tool-use attack that could survive beyond the session that introduced it.

Opus 4.7 and GPT-5.5 never allowed credential exfiltration in the reported tests, according to the memory-attack summary. That result is the least comforting 0% in the paper, because the same summary says unauthorized tool use still succeeded at high rates across almost every tested model.

The attack surface was not just secrets leaving the box. It was trusted memory causing the agent to do the wrong ordinary thing later.

The Severance paper names a different memory failure: assistants know the fragment of a person that made it into context, then act as if the fragment is the person.

The paper's useful distinction is visible in its figure:

• Model context: recent messages, work queries, uploaded files, known preferences, past interactions
• Real life: relationships, experiences, emotions, goals, choices, surprises, growth, environment

Memory made the gap worse in the experiments. TheTuringPost's summary says hallucinations rose from almost zero to as high as 11.7% because models filled in missing life context from remembered fragments.

The proposed fix was not bigger memory. The paper's Severance Schema forced models to track what they knew and what remained unknown, which the arXiv version says reduced harmful advice and sycophancy across five model families.

A third paper, AI Agents Do Not Fail Alone, turns context quality into an eval target. ProofAgent-Harness scores context with multi-juror consensus, separately from the agent's downstream behavior.

The seven scored criteria are:

1. Role clarity
2. Guardrail coverage
3. Instruction consistency
4. Tool schema quality
5. Grounding sufficiency
6. Injection hardening
7. Token efficiency

The reported correlations are clean enough to remember: grounding sufficiency predicted hallucination resistance, guardrail coverage predicted manipulation resistance, and tool-schema quality predicted tool use, according to the ProofAgent-Harness note.

The context-layer pattern separates the thing that remembers from the thing that chats. pauliusztin_'s architecture post splits the stack into unified memory, an MCP serving layer, and a disposable harness.

The concrete pieces are:

• Unified memory: documents, full-text search, semantic search, and graph traversal in one store
• Serving layer: MCP tools and business logic for search, writes, tool exposure, and memory promotion
• Harness: Claude Code, Codex, OpenCode, Gemini CLI, or any UI that can call the serving layer

The lock-in claim is blunt: the model and harness change faster than the context layer. That makes memory portability the least glamorous part of the stack and the one everyone ends up caring about.

Memory systems are also running into ordinary infrastructure costs. the indexing post argues that the append-only log can stay on disk while only the materialized knowledge graph gets a vector index, cutting the illustrated RAM footprint from about 40 GB to about 10 GB.

Wiki memory is the higher-level version of the same compression move.

the wiki-memory tradeoff post listed the tradeoff cleanly:

• No GraphRAG over the entire knowledge base
• Existing data can stay in Notion, Google Drive, CRMs, and similar systems
• The second query gets faster because the wiki compounds
• Markdown stays inspectable
• Persistent wiki synchronization remains unsolved
• The pattern fits recurring research better than one-off questions

The 1Password complaint shows the human-interface problem around agent memory and tools. Kun Chen's dialog post says the prompt identified herdr, but not the child agent process, working directory, or reason for access.

A follow-up from the same thread clarified the missing control boundary: herdr was acting like a container, while Claude and Codex were the child processes requesting access.

Two community projects map the alternative pattern:

• Treg: the launch post describes a skill and secret registry where auth is injected server-side, agents never hold keys, and every call is logged per agent or user. The project is also published as the tools-registry GitHub repo.
• BrokerKit: the setup post describes brokered GitHub, Hugging Face, and sudo access with timed requests, PR-only defaults, and an agent running under its own Linux user. The implementation lives in the BrokerKit repo.

Claude Code shipped three relevant releases in the same week as the memory papers and community reports.

• 2.1.212: the changelog thread added a default 200-call session cap for WebSearch and a default 200-spawn session cap for subagents, with /clear resetting the subagent budget.
• 2.1.212: The same release fixed plan mode auto-running file-modifying Bash commands such as touch and rm without a permission prompt, according to the detailed 2.1.212 note.
• 2.1.214: the 2.1.214 release post added an EndConversation tool, Docker and Podman daemon-redirect permission prompts, and exact-string replacement behavior for the Edit tool.
• 2.1.214: Commands over 10,000 characters now always prompt instead of running automatically, according to the detailed 2.1.214 changelog.
• 2.1.215: the 2.1.215 release post says /verify and /code-review no longer auto-run and must be invoked explicitly.
• 2.1.215: the prompt-diff note says prompt tokens rose by 6,001, system-prompt share rose from 26.0% to 38.4%, and the assistant now always uses the Grep search tool for search tasks.

User-level memory files became a parallel guardrail surface. After Fable automatically spun up 52 subagents for PR scans and exhausted quota, Kun Chen's AGENTS.md update added a global rule requiring explicit approval before large subagent swarms.