'SpAIware': ChatGPT memory poisoning turned the assistant into a persistent spy, exfiltrating every future chat
OpenAI (ChatGPT memory feature) · Sep 20, 2024 · General agent
What happened
Johann Rehberger (Embrace The Red) demonstrated 'SpAIware': a malicious website uses indirect prompt injection to invoke ChatGPT's memory tool and plant a persistent instruction that appends the user's chat data into image-render URLs pointing at an attacker's server. Every future conversation is then silently exfiltrated, across sessions. OpenAI had earlier dismissed memory manipulation as a non-security issue before the end-to-end proof of concept.
Causal vector
Prompt injection → memory-tool poisoning for persistence → image-render exfiltration channel
Source
Reported by Embrace The Red (Johann Rehberger). Verified against the primary report.
Persistence makes this worse than one-shot injection — the poisoned memory re-arms the exfil channel in every new session. A defence enforced outside the model (an egress allowlist on every outbound request the agent triggers) survives both the initial injection and the persistent payload.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Google's Antigravity IDE vulnerable to data exfiltration and remote code execution via prompt injection
Google · Nov 25, 2025
State-sponsored group automates ~80–90% of a cyber-espionage operation using Claude Code and MCP tools
Anthropic (Claude Code, abused by a threat actor) · Nov 1, 2025
Windsurf Cascade coding agent leaks developer secrets via indirect prompt injection
Windsurf (Cascade) · Aug 21, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.