Cisco Shows How Poisoned Memory Can Persist in Claude Code
Summary
Cisco researchers demonstrated that NPM post-install hooks could modify Claude Code’s memory file, preserving malicious instructions across sessions. Anthropic has mitigated the issue; researchers recommend scanning or purging memory files.
Key points
- Cisco researchers used NPM post-install hooks to modify Claude Code’s memory.md file and persist malicious instructions across sessions.
- The demonstration could add hard-coded secrets to production code, steer Claude Code toward insecure packages and configurations, and push changes to another team member.
- The first 200 lines of memory.md were included in Claude Code’s system prompt, enabling the instructions to affect later sessions.
- Anthropic has mitigated the reported issue.
- Researchers describe prompt injection as a root cause of memory poisoning risks in AI agents and generative AI applications.
- Cisco and other security vendors have developed tools to scan memory and dependency files; one researcher recommends purging memory when its integrity is in doubt.
Article Details
- Event Type
- Cisco researchers demonstrated persistent memory poisoning in Anthropic’s Claude Code through NPM post-install hooks.
- Impact
- According to Cisco, the technique modified Claude Code’s memory.md file and persisted across projects and sessions. Researchers said it could introduce hard-coded secrets into production code, lead the assistant to select insecure packages and configurations, and push resulting changes to another team member. Anthropic has since mitigated the issue. The article also describes memory poisoning and indirection prompt injection as broader risks to AI agents and connected services.
People
Vendors
AnthropicCisco demonstrated a persistent compromise of Anthropic’s Claude Code by modifying memory.md via NPM post-install hooks, underscoring prompt-injection and memory-poisoning risks and the need to scan or purge memoryCiscoCisco demonstrated a persistent compromise of Anthropic’s Claude Code by modifying memory.md via NPM post-install hooks, underscoring prompt-injection and memory-poisoning risks and the need to scan or purge memoryMetamemory files are hard to detect, various AI security vendors, including Cisco, Palo Alto Networks, Snyk, Meta, and SentinelOne, have developed tools to scan memory files for malicious modifications and to blockPalo Alto Networksare many other vectors, says Jay Chen, senior principal security researcher with cybersecurity firm Palo Alto Networks, which published research on memory manipulation last October.Radwarecan insert fake memories into the data used by AI, manipulating its responses and decisions, while Radware threat researchers demonstrated ways to use indirection prompt injection (IPI) to compromise theSentinelOneare hard to detect, various AI security vendors, including Cisco, Palo Alto Networks, Snyk, Meta, and SentinelOne, have developed tools to scan memory files for malicious modifications and to block attacks on AISnykto memory files are hard to detect, various AI security vendors, including Cisco, Palo Alto Networks, Snyk, Meta, and SentinelOne, have developed tools to scan memory files for malicious modifications and to block
Products
ChatGPTways to use indirection prompt injection (IPI) to compromise the connectors used by OpenAI’s ChatGPT to link to third-party services.Claude CodeCisco demonstrated a persistent compromise of Anthropic’s Claude Code by modifying memory.md via NPM post-install hooks, underscoring prompt-injection and memory-poisoning risks and the need to scan or purge memoryCodexOther dependency files — such as claude.md (Anthropic’s Claude), agents.md (OpenAI’s Codex), and soul.md (OpenClaw) — are also risks that users of agentic AI will have to analyze and maintain, Cisco’s Chang says.npmCisco demonstrated a persistent compromise of Anthropic’s Claude Code by modifying memory.md via NPM post-install hooks, underscoring prompt-injection and memory-poisoning risks and the need to scan or purge memoryOpenClawOther dependency files — such as claude.md (Anthropic’s Claude), agents.md (OpenAI’s Codex), and soul.md (OpenClaw) — are also risks that users of agentic AI will have to analyze and maintain, Cisco’s Chang says.