Poisoned Memory Files Reinfect Claude Code, Codex Sessions

Poisoned memory files reinfect every future session they load into, per a paper posted July 16 to arXiv (2607.14611). The researchers planted prompt injection inside the persistent memory files that agentic coding tools write and re-read across sessions. They ran the attack against both Anthropic's Claude Code and OpenAI's Codex, across Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Two harnesses, four model tiers.

Anyone with a CLAUDE.md or a memory directory that an agent writes to is in scope, not just people using one vendor's tool. A poisoned web page injects once, into one session, and it clears with the context. A poisoned memory file injects into every session that loads it after.

That distinction matters for how I run my own setup. My agents write to memory without me reviewing every line. That's the point of persistent memory, not a shortcut I'm taking. It means the boundary between content an agent pulled from a source and instructions I actually gave it sits in the same file. Nothing marks which is which.

What else landed the same day

Claude Code practice guidance adds a second data point: as CLAUDE.md grows, the odds of any instruction getting ignored go up. Brevity becomes a performance requirement, not a style preference. Creed also launched on Product Hunt, pitching a portable personal-context file meant to follow you across every agent instead of getting re-entered per tool. Put that next to the security paper and a poisoned Creed file doesn't stay contained to one harness. It follows you into every tool you run.

None of the fixes need new tooling. Put memory files under version control and read agent-written diffs like a PR from a stranger. Separate agent-writable memory from human-authored instructions into different files, and load only the human-authored one at full trust.

My bet: most people running Claude Code or Codex have zero diff review on their memory files. That gap gets exploited before anyone patches it.