Cases › security breach › LR-2026-0489

Persistent memory compromise found in Claude Code

Confirmed Why: Cisco's own report · Cisco · 1 independent report

Status: fix reported

Severity minor

Reported 1 Apr 2026

Developer and model Anthropic

Agent tool Claude Code

No source states: loss or records, could do, deployer, industry.

Severity minor: Test scope: the quoted sentence describes a benign proof-of-concept injection in one evaluation, and no third party is stated as touched.

Researchers at Cisco demonstrated a proof-of-concept attack on Claude Code, an AI coding agent that reads persistent memory files. Its memory files are loaded into the system prompt and treated as trusted user instructions. The attack entered through an npm postinstall hook that ran during a package installation the user approved. The payload overwrote project memory files and the global hooks configuration, and appended a shell alias that re-enabled auto-memory at each launch. In the demonstration, the poisoned agent recommended storing an API key in a committed source file and gave no security warnings. The researchers reported the findings to Anthropic, which, as of Claude Code v2.1.50, removed user memories from the system prompt. Anthropic stated that users are ultimately responsible for vetting dependencies.

What happened

1 · What went wrongMemory file content was treated as trusted instructions from the user.

What was done

Anthropic removed user memories from the system prompt.

Fix reported

“Anthropic removed user memories from the system prompt as of Claude Code v2.1.50.”

Same developer, same risk, after the fix: LR-2026-0086 · LR-2026-0089 · LR-2026-0578

Risks

Hidden instructions hijack the agent
Primary50 incidents
Rising: 6 vs 2.8 a week

Read from the sources; not yet reviewed by a person.

Controls

Harness

Did not exist Memory hardening

Control failure chain

L1 · Model Not stated in sourcesAnthropic

L2 · Harness Did not existClaude Code

L3 · Application Not stated in sourcesDeployer not named

L4 · Infrastructure / target Not stated in sourcesOrganisation hit

L1 · ModelAnthropicModel provider

No source mentions a control at this layer.

Model version not linked to a model card.

L2 · HarnessClaude CodeAgent framework vendor

Did not existMemory hardening“When there is no strong boundary between these sources, an attacker who can write to “trusted” instruction surfaces can reframe the agent’s behavior in a way that appears legitimate to the model.”Cisco Blogs

Other controls for this risk at this layer, not mentioned in the sources: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.

L3 · ApplicationDeployer not namedDeployer

No source mentions a control at this layer.

Other controls for this risk at this layer, not mentioned in the sources: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.

L4 · Infrastructure / targetOrganisation hit

No source mentions a control at this layer.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Memory hardening	L2 Harness	Did not exist
Tool allow-list	L2 Harness	Not stated in sources
Confirmation after untrusted input	L2 Harness	Not stated in sources
Outside content treated as data, not instructions	L2 Harness	Not stated in sources
Prompt-injection detection	L2 Harness	Not stated in sources
Validation of tool inputs and outputs	L2 Harness	Not stated in sources
Least-privilege access for the agent	L3 Application	Not stated in sources
Human approval for high-impact actions	L3 Application	Not stated in sources
Segmentation of agent components	L3 Application	Not stated in sources
Alerts on unusual tool use	L3 Application	Not stated in sources

Similar incidents

Indonesian-speaking operator uses Claude Code to compromise Indonesian and Bangladeshi government domains2026-10-26

Claude Code Auto Mode: website summary leads to remote code execution via Python module shadowing2026-09-01

Claude Code GitHub Action prompt-injection flaw could expose GitHub credentials2026-06-06

Accenture contractor's Claude Code agent leaked NIPRNet credentials and network map to third-party website2026-10-30

All cases of this kind ›

Evidence

No source states: what the AI was doing, what it reached or did, how it was caught, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

Not dated in the sources:

Researchers discovered the memory persistence method.
Researchers reported the findings to Anthropic.
Anthropic shipped a mitigation in Claude Code v2.1.50 that removes user memories from the system prompt.

Show every field, with its source and grade

The AI system

Developer

Anthropic

C one secondary source states it

Software around the model

Claude Code

C one secondary source states it

How much it acted alone

a person approved each action

C one secondary source states it

What it was for

AI coding assistant for software development

C one secondary source states it

What happened

Earliest source we hold

2026-04-01

D inferred by us from the described behaviour, reason shown

Who caught it

an independent researcher or journalist

C one secondary source states it

What was done

Anthropic removed user memories from the system prompt as of Claude Code v2.1.50.

C one secondary source states it

What went wrong

security breach

C one secondary source states it

AI agent

an AI agent acted

C one secondary source states it

primary risk

RK01

D inferred by us from the described behaviour, reason shown

control chain

layer: L2; party: harness vendor; control id: E5; outcome: missing; quote: When there is no strong boundary between these sources, an attacker who can write to “trusted” instruction surfaces can reframe the agent’s behavior in a way that appears legitimate to the model.; source index: 0

C one secondary source states it

Impact

Severity

minor

D inferred by us from the described behaviour, reason shown

Why this severity

Test scope: the quoted sentence describes a benign proof-of-concept injection in one evaluation, and no third party is stated as touched.

D inferred by us from the described behaviour, reason shown

Notes on gaps

Responsibility is not assigned: the post reports Anthropic's position that the user is trusted and responsible for dependencies, which is not adopted as a finding.

LR-2026-0489 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON