MemoryBrain
Can a note or memory file manipulate my agent?
Yes. Text an agent reads can try to give it instructions unrelated to your request. Review changes to instruction and memory files, limit permissions and keep sources. These are hygiene measures, not a guarantee of protection.
Review what will become instructions
Check the file’s origin
Before using someone else’s repository or template, read its instruction files. Ask who wrote them, what changed and why. A note containing a quotation should remain reference material even when the quotation includes commands.
Review what the agent saves
Inspect proposed changes to CLAUDE.md, AGENTS.md and auto memory notes. Look for rules that disable checks, expand permissions or contradict the task. Review apparently helpful corrections too. Keep a history so you can inspect and revert changes.
Limit available tools
If the task is to consult notes, use read-only access where the client and server support it. Check actual permissions: writing “do not change anything” does not remove a write tool. Read-only access reduces possible modifications but does not prevent text from attempting to influence an answer.
Keep quotations out of instruction files
Do not paste unreviewed pages, emails or strangers’ replies into a file the agent will load as rules. Keep the original with its source in a separate document. If you need a rule, write it yourself after deciding what you accept.
Check the result
Review the final code or document and run checks appropriate to the change. If you find a suspicious instruction, stop the affected task, preserve the change for review and restore a known version before continuing.
What the paper studied and found
The preprint Security Impact of Coding Agent’s Memory Files, submitted on October 28, 2026, studied malicious instruction files in code generation tasks. It compared Claude Code and OpenCode with and without these files.
The abstract reports changes from minus 8 to plus 6 percentage points in secure completion rates, without a consistent pattern across agents or variants. That is an experimental result, not the probability that one of your notes will cause an attack.
The discussion and limitations state that runs were not repeated and statistical significance cannot be demonstrated. The study does not measure attack frequency in real repositories or evaluate credential theft or exfiltration. Detecting or mentioning the file did not reliably indicate whether code was secure. We do not generalize its results to every personal memory system.
What official guidance adds
Anthropic describes prompt injection as adversarial instructions embedded in content an agent processes and acknowledges that the problem remains unsolved. That publication concerns browser use; it does not evaluate every kind of memory file.
OpenAI recommends keeping untrusted input out of developer messages, constraining data flow and reviewing tool operations. Applied to these notes, our recommendation is to separate reference material from approved instructions and grant only necessary permissions. A prompt cannot replace those controls.
Provenance helps review; it does not confer immunity
MemoryBrain keeps note sources and separates reading material from your opinion. That can help you review what you retrieve. We do not claim protection against prompt injection. A visible source still needs judgment and appropriate permissions.
More: what CLAUDE.md and AGENTS.md do and memory with sources.
Frequently asked questions
Is every note containing instructions an attack?
No. It could be a legitimate rule or a quotation. Review its origin and whether its author had authority to change the task.
Does read-only access eliminate the risk?
No. It limits changes to the source, but the content read can still attempt to influence the agent.
Is it enough for the agent to say it detected the attack?
No. In the cited study, recognizing suspicious instructions did not guarantee secure code. Review the result and its checks.
Try it
See how a memory that keeps the source of everything works, no account needed.
Sources
- Santos de Moura, Güler and Noller, Security Impact of Coding Agent’s Memory Files, abstract. October 28, 2026. Accessed November 8, 2026.
- Same preprint, PDF: methodology, discussion and limitations. October 28, 2026. Accessed November 8, 2026.
- Anthropic, Mitigating the risk of prompt injections in browser use. November 24, 2025. Accessed November 8, 2026.
- OpenAI, Safety in building agents. n.d. Accessed November 8, 2026.