Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-20 · high
Both harnesses and four model tiers failed the same way, meaning this isn't a single vendor's bug to patch.
Why now: The paper posted July 16, four days before the July 20 roundup that also covered Claude Code practice guidance and Creed's cross-agent memory pitch.
Poisoned memory files reinfect every future session they load into, per a paper posted July 16 to arXiv (2607.14611). The researchers planted prompt injection inside the persistent memory files that agentic coding tools write and re-read across sessions. They ran the attack against both Anthropic's Claude Code and OpenAI's Codex, across Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Two harnesses, four model tiers.
Anyone with a CLAUDE.md or a memory directory that an agent writes to is in scope, not just people using one vendor's tool. A poisoned web page injects once, into one session, and it clears with the context. A poisoned memory file injects into every session that loads it after.
That distinction matters for how I run my own setup. My agents write to memory without me reviewing every line. That's the point of persistent memory, not a shortcut I'm taking. It means the boundary between content an agent pulled from a source and instructions I actually gave it sits in the same file. Nothing marks which is which.
Claude Code practice guidance adds a second data point: as CLAUDE.md grows, the odds of any instruction getting ignored go up. Brevity becomes a performance requirement, not a style preference. Creed also launched on Product Hunt, pitching a portable personal-context file meant to follow you across every agent instead of getting re-entered per tool. Put that next to the security paper and a poisoned Creed file doesn't stay contained to one harness. It follows you into every tool you run.
None of the fixes need new tooling. Put memory files under version control and read agent-written diffs like a PR from a stranger. Separate agent-writable memory from human-authored instructions into different files, and load only the human-authored one at full trust.
My bet: most people running Claude Code or Codex have zero diff review on their memory files. That gap gets exploited before anyone patches it.
Each link below shares sources, entities, or timing with this story.
Codex competes with Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, CLAUDE, Claude Code, Claude Opus; overlapping topics (claude, code).
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, Claude, Claude Code, Codex; overlapping topics (agent, claude, code).
Anthropic released Claude / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released Claude); both cover Claude, Codex, July, Product Hunt; reported by the same outlet (arxiv.org, producthunt.com).
VS Code supports Codex / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (VS Code supports Codex); both cover Anthropic, CLAUDE, Claude Code, Codex; overlapping topics (agent, claude, code).
OpenAI released Codex / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (OpenAI released Codex); both cover Claude Code, Codex, GPT, OpenAI; reported by the same outlet (arxiv.org).
OpenCode competes with Codex / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (OpenCode competes with Codex); both cover Claude Code, Claude Opus, Codex, GPT; reported by the same outlet (producthunt.com).
Codex competes with Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, Claude, Claude Code, GPT; overlapping topics (agent, claude, code).
Linked by a graph relationship (Codex competes with Claude Code); both cover Anthropic, Claude, Claude Code, GPT; overlapping topics (agent, claude, code).