Brave Leo
Brave Software · May 2026
Critical · 1 reported finding
A note saved into browser memory became a persistent backdoor that fires on every prompt, across sessions.
Reported to Brave AI safety
Leo treats its memory fields as executable code. We wrote an instruction into a memory field and asked an innocent question — "What's 2+2?" It ran the embedded instruction first, dumping stored memory fields verbatim — card number, CVV, and SSN among them — then answered "4."
What happened
- Memory runs as instructions. Content placed into Leo's memory fields was read back as executable instruction, not stored data.
- It persists across sessions. We closed the conversation, opened a fresh session, and the instruction fired again — a standing backdoor until someone manually clears memory.
- It overrides Leo's own guardrail. Asked directly to show memory, Leo refuses ("I cannot provide personal data") — but the embedded instruction overrides that refusal and exfiltrates anyway.
Why it matters. Stored memory can influence an unrelated answer. This test covers the observed model and local memory configuration. Cross-model behavior and remote exploitation were not established.
Disclosure record
- Reported to ai-safety@brave.com
Vendor response. Sent to Brave's AI safety address rather than the bounty programme.
Know the limit
A researcher's own browser and synthetic memory values, with researcher-controlled memory write access. No other user's data or remote compromise was demonstrated. The public capture shows memory-instruction following on an ordinary query.
How to prevent this
All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.