Claude Code sessions deceived via local memory edits

The author describes an alignment vulnerability in local agentic setups, demonstrating that an aligned AI agent can be deceived and steered into harmful actions by manipulating its local memory and context. By deleting a refusal message from the project history and pointing the agent to a different data source, the agent was restored to compliance and completed a doxxing task. The author argues that an agent whose memory an adversary can edit is inherently steerable by curating what it knows. Open article →