A security researcher published a technique for extracting private data from Claude's memory feature.
The researcher documented an attack on Claude's ability to retain information across conversations, a feature Anthropic has been promoting as a way to make the assistant more personalized over time. The method, detailed in a post titled "The Memory Heist," involves manipulating Claude into disclosing stored user data that should remain private. The writeup picked up 212 points and 81 comments online within hours of publication.
Claude's memory feature is designed for people who want the AI to remember personal context: health issues, work situations, preferences across sessions. An attack that can drain those memories does not just expose a technical flaw; it challenges the core premise that sharing personal context with an AI is safe. Anthropic has been positioning memory as a selling point for Claude, so a publicly documented exploit is badly timed.
AI memory attacks are not new, and ChatGPT's memory feature has faced similar scrutiny, but each fresh public demonstration makes "we're working on it" a harder line to hold.