SpAIware: Turning ChatGPT's Memory into Persistent Spyware
On this page
The attack that made a one-shot prompt injection permanent — by writing itself into ChatGPT's memory.
| When | September 2024 |
|---|---|
| Target | ChatGPT (long-term Memory) |
| Vendor | OpenAI |
| Researcher | Johann Rehberger (Embrace The Red) |
| Technique | Indirect injection writes persistent memory → ongoing exfil |
| Fixed in | ChatGPT 1.2024.247 (URL validation) |
- 1User asks ChatGPT to analyse a web page or document carrying hidden instructions
- 2The instructions write attacker-controlled entries into ChatGPT's long-term memory
- 3Every later conversation is exfiltrated via a rendered image URL carrying the data
What happened
In September 2024, researcher Johann Rehberger demonstrated SpAIware: hidden instructions in a web page or document that ChatGPT was asked to analyse could silently write attacker-controlled entries into ChatGPT's long-term Memory. Because Memory persists across sessions, a single injection became standing spyware — every future conversation was quietly exfiltrated.
How the attack worked
The planted instructions told ChatGPT to remember a directive, and then to emit a markdown image on each turn whose URL had the conversation appended as parameters. ChatGPT rendered the image, so the browser fetched the attacker's server automatically — leaking the chat with no visible sign.
Root cause
- Untrusted content could write durable state. Model output influenced by injected text was allowed to persist into Memory with no validation.
- An open exfiltration channel: the client auto-rendered images to arbitrary URLs, carrying data outward.
What a test would have caught
A test that feeds the assistant untrusted content and then checks (a) whether it writes anything to durable memory and (b) whether it will render an outbound URL would have caught the persistence and the exfil channel.
How to prevent it
Treat everything the model ingests as untrusted; never let model output write to durable memory without validation; and constrain the URLs the client will auto-fetch. OpenAI's fix applied a URL-safety check before rendering, closing the exfiltration channel.
Feel it yourselfThe replay lab lets you poison an assistant's long-term memory so the compromise survives into the next session.
FAQ
Why is a memory attack worse than a normal injection?
A normal prompt injection affects one conversation. By writing malicious instructions into ChatGPT's persistent memory, the attacker made the compromise survive across sessions — every future chat was silently exfiltrated until the memory entry was removed.
How was the data exfiltrated?
Through rendered markdown images: the planted instructions told ChatGPT to emit an image whose URL had the conversation appended as parameters, so the browser fetched the attacker's server automatically.
How do you defend against this?
Treat any content the model ingests as untrusted, never let model output write to durable memory without validation, and block the exfiltration channel — validate and constrain the URLs the client will auto-fetch (which is what OpenAI's fix did).