ChatGPT's Memory Feature Supercharges Prompt Injection

Radware researchers have identified a new exploit chain called “ZombieAgent” that leverages ChatGPT’s memory feature and connectors to intensify prompt injection attacks. The attack chain shows how long-term memory can be abused to make IPI attacks persistent, with instructions stored in memory to carry out exfiltration or other malicious actions on prompt, such as reading and transmitting sensitive information.

Old prompt injection techniques remain viable, including embedding malicious prompts in emails linked to ChatGPT via connectors, and exfiltrating data through encoded URL fragments. OpenAI has since blocked modified URLs and limited URL access to user-provided or public-indexed domains, partly neutralising ZombieAgent, though Radware argues that deeper, structural fixes are still required.

The article notes that you can ask ChatGPT to remember a name or detail, which could be exploited to maintain malicious instructions until told otherwise, and it cites Pascal Geenens of Radware urging improved trust and intent understanding in AI agents. According to Radware, the issue is unlikely to be resolved soon, and researchers warn that even a seemingly benign prompt could trigger a data‑theft or privacy breach via an infected memory. 8 January 2026