Memory Poisoning Turns Crypto Agents Into Trojan Horses — Sign or Die

Prompt injection has a new frontier: persistent memory. A recent paper evaluating Anthropic Claude Code and OpenAI Codex across four models — Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5 — reveals a dangerous asymmetry [^claim_2285]. While it is difficult to make an agent overwrite its own memory files using untrusted external content [^claim_2286], payloads already planted in those files can successfully attack both current and future sessions [^claim_2287]. The attack success and payload persistence vary substantially across systems, models, adversarial goals, and multi-session attack sequences [^claim_2288].

For crypto, this shifts the threat model. Autonomous agents managing on-chain assets — DeFi trading bots, MEV searchers, DAO treasury delegates, cross-chain relayers — increasingly rely on persistent memory to store preferences, routing rules, and behavioral constraints. A one-time compromise of that memory store, perhaps via a compromised dependency or a malicious update, plants a payload that subverts every subsequent action. The agent does not need to be re-exploited; the memory does the work.

The paper’s core finding is that persistent memory changes the threat model for prompt injection and motivates defenses that protect memory updates without removing useful agent adaptation [^claim_2289]. For crypto agents, this maps directly to a need for signed or attested memory. Instead of trusting the LLM’s self-censorship, memory writes should require a cryptographic signature from a known key — stored on-chain or in a TEE-attested enclave. This mirrors how smart-contract wallets use session keys with explicit permission scopes, but applied to the agent’s persistent state rather than transaction authorization.

The variance across models [^claim_2288] means that security guarantees are not uniform. A builder deploying on Claude Opus 4.7 might face different memory-injection resilience than one on GPT-5.2. Model choice becomes a security parameter, analogous to selecting a zk-prover with different soundness assumptions. Teams must test their specific agent stack against memory-poisoning attacks, not assume generic safety.

One memory-poisoning event can subvert all future sessions. The defense — cryptographically binding memory writes to authorized keys — is a natural fit for blockchain-based identity and attestation primitives. Watch for agent frameworks that adopt signed memory or on-chain attestation as a core security primitive.