Observation

With standard prompt injection attacks, AI browsers read an attacker’s instructions and execute them only a single time. But there’s a more sophisticated form of prompt injection called memory poisoning. Attackers inject malicious instructions into your AI’s account-specific memory, which is retained across all your devices in each and every session. For example, an attacker could use memory poisoning to have your browser leak your most recent emails each day, instead of just the one time it reads malicious instructions. Hackers can use this tactic to compromise your data and hijack access across multiple devices where you use the same AI browser, which is even more of a threat with cross-platform browsers like Comet and Dia.

ChatGPT Atlas: Go to Settings > Personalization. Toggle off Reference browser memories to prevent ChatGPT from retaining any memory from your previous chat sessions. This will effectively prevent it from getting better at your tasks by learning from your data, but it will also shield you from attacks that specifically target this feature. OpenAI notes that ChatGPT Atlas has built-in security filters that restrict access to sensitive information like government ID, bank account or credit card numbers, and SSNs. But disabling browser memories entirely offers much better safety.

If that feels too extreme, you can also use incognito mode when performing any tasks that you’d rather not have relegated to your browser memory, or go to Settings > Personalization > View browser memories to delete or archive memories you don’t want retained. Perplexity Comet: You can go to comet://settings/ > Privacy and security > Delete browsing data to clear your browsing history, cache, and cookies. To delete saved AI memories from your Perplexity account, you can navigate to New Tab Page > Account > Preferences > Memory, where you can choose to disable memory retention by toggling off Use search history and Notes.