Yes—at least in a 2024 security demonstration, malicious instructions hidden in untrusted content caused ChatGPT to save incorrect information or instructions for use in later conversations. The incident was a prompt-injection proof of concept, not evidence that ChatGPT has human-like autobiographical memory. The sources reviewed do not establish whether the same exploit still works in the current product.
What “false memories” means in this report
The phrase comes from a September 29, 2024 Futurism report about security researcher Johann Rehberger’s work. In technical terms, the “memory” was information or instructions placed in ChatGPT’s persistent memory feature. It was not a human-style recollection formed through lived experience.
As an Amazon Associate I earn from qualifying purchases.
Rehberger summarized the mechanism to Futurism this way: “The prompt injection inserted a memory into ChatGPT’s long-term storage.” That description refers to a product capability that can retain details across conversations, not to consciousness or personal memory.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →How the attack worked
Indirect prompt injection
An indirect prompt injection occurs when a model processes content from an outside or otherwise untrusted source and follows instructions embedded in that content. The instructions might be hidden in a document, webpage, or other material that a user asks ChatGPT to analyze.
#1 Best Overall
In the 2024 proof of concept, the malicious content persuaded ChatGPT to write information into long-term memory. The stored material could be false or could function as an instruction. Because the memory could affect later chats, a one-time encounter with hostile content had a persistent effect.
Persistence changed the risk
An ordinary prompt injection may influence one response. A memory-writing injection can influence future conversations after the original document or message is no longer visible. That persistence is the central security concern described by Rehberger and in the associated research paper on persistent prompt injection.
Memory manipulation and data exfiltration are different
The demonstration also examined a route for sending data to an external destination. That is a separate consequence from planting false information in memory:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Memory manipulation: incorrect information or instructions are saved and may shape later chats.
- Exfiltration: information is transmitted outside the service.
Ars Technica’s 2024 account said OpenAI had mitigated the exfiltration vector while, according to the researcher at that time, the memory-write concern remained. That was the status reported during the demonstration; it should not be treated as a verified description of ChatGPT’s security in 2026.
Does the old exploit still work?
The available reporting does not answer that question. It documents a historical proof of concept and later general product guidance, but it does not provide a current retest of the specific vulnerability. ChatGPT’s memory implementation, model behavior, safeguards, and account controls may have changed since September 2024.
It is therefore accurate to say that the attack was demonstrated, not that every current ChatGPT account remains vulnerable or that the exploit is reproducible today.
How to check and remove ChatGPT memories
OpenAI’s current documentation says users can review, correct, or delete remembered information and can disable memory-related features. Exact menu names and availability can vary by account, plan, region, and product updates.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use the memory controls
- Open ChatGPT’s settings.
- Open the section labeled for Personalization, Memory, or a similar control.
- Review the saved memories ChatGPT shows.
- Correct or delete entries you do not recognize or no longer want retained.
- If you do not want the feature to operate, turn off the available saved-memory and chat-history reference controls.
Use Temporary Chat for a conversation that should not affect memory
OpenAI recommends Temporary Chat for conversations that should not use or update memory. Choose that mode before sharing sensitive material or processing content from an untrusted source. Temporary Chat is a product control, not a guarantee that every other form of data handling or prompt injection is impossible.
Best Value
Delete both the memory and its source chat when necessary
Deleting a conversation does not necessarily remove a separately saved memory derived from it. To remove a remembered detail completely, OpenAI says you may need to delete the saved memory and the chat in which the information originally appeared. Check both locations rather than assuming that deleting one removes the other.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What users should do with untrusted content
- Treat instructions inside documents, webpages, emails, and copied text as potentially hostile, even when the surrounding content looks legitimate.
- Do not ask ChatGPT to treat material from an external source as higher-priority instructions than your own request.
- Review memory entries periodically, especially after using features that process files or outside content.
- Keep memory disabled or use Temporary Chat when persistence is unnecessary.
- Verify important facts independently instead of trusting a remembered detail simply because it appears in a later conversation.
What this incident does—and does not—prove
| Question | What the available evidence supports |
|---|---|
| Can ChatGPT store incorrect information? | Yes. The 2024 demonstration showed that prompt-injected content could cause incorrect information or instructions to be saved in memory. |
| Does that mean ChatGPT has human memory? | No. The term “false memories” describes persistent product data, not human-like experience or autobiographical recollection. |
| Was data theft demonstrated? | A separate exfiltration path was explored in the proof of concept. It should not be conflated with the memory-writing behavior. |
| Is the same vulnerability confirmed today? | No current confirmation is established by the reviewed sources. |
| Can deleting a chat remove every related memory? | Not always. A separately saved memory may also need to be deleted. |
The practical takeaway
The 2024 finding is best understood as a warning about persistence: untrusted content can be more dangerous when an AI assistant is allowed to retain information for future chats. Check what ChatGPT has saved, remove entries you cannot verify, disable memory when it is not needed, and use Temporary Chat for conversations that should not update memory. Those steps reduce exposure, but they do not establish that the historical exploit is either fully fixed or currently reproducible.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
