Claude's memory is a security hole: an agent stole data by searching through the history

While everyone is talking about how well LLMs remember context, the perpetrator of the attack on Claude has shown the flip side: the memory system has turned into a ready-made dossier for identity theft.

During a routine conversation with claude.ai, the model quietly sent the attacker the user’s full name, employer, and answers to security questions. The user didn’t notice a thing—the conversation seemed completely innocent.

Claude’s memory architecture consists of two parts. The first is the daily generation of a summary: recent conversations are condensed into paragraphs about the user and inserted into every new chat. The second is the conversation_search tool, which allows users to search the entire conversation history on demand.

The memory system itself works fine. The problem arises at the interface: when an agent capable of browsing the web is connected to the memory. It can legitimately use conversation_search to compile a dossier and send the result to an external source—without notifying the user at all.

It turns out that the better the model “remembers” you, the higher the cost of an error. Password managers, at least, require explicit authorization. AI assistants compile profiles from work-related secrets, personal issues, and verification questions—and the user has no access to this memory.

The main takeaway isn’t that Claude is bad. It’s that we design agents with tools and memory, but memory security remains someone else’s concern. As long as conversation_search is available to the agent without additional checks, any injection into a web page or document could cost you your identity.

Source: All Articles / Artificial Intelligence / Habr