Llm Memory Audit Prompts

# Audit Your LLM Memory: Prompt Recipes for Business Users

**By [Blane Warrene](https://github.com/enalbenerraw/blanewarrene)** | [Substack](https://blanewarrene.substack.com)

---

## TL;DR

Business users are adopting AI faster than they're learning how it behaves — and that creates risk. Assistants can quietly retain instruction-like content (conditional rules, output constraints, fake "policies") that outlives the conversation it came from. This repo gives you copy-paste prompt recipes to audit the persistent memory and instructions in ChatGPT, Claude, Microsoft Copilot, and Gemini — plus a protective wrapper prompt for pasting untrusted content. Run them on a recurring schedule.

---

## Table of Contents

- [The Risk](#the-risk)
- [What "Memory" Actually Includes](#what-memory-actually-includes)
- [The Three-Step Audit Framework](#the-three-step-audit-framework)
- [Prompt Recipes](#prompt-recipes)
  - [ChatGPT (OpenAI)](#chatgpt-openai)
  - [Claude (Anthropic)](#claude-anthropic)
  - [Microsoft Copilot](#microsoft-copilot)
  - [Gemini (Google)](#gemini-google)
- [Protective Wrapper Prompt](#protective-wrapper-prompt)
- [Bottom Line](#bottom-line)
- [License](#license)

---

## The Risk

Business users are adopting AI faster than they are learning how it actually behaves. That gap creates a new class of risk: not "AI goes rogue," but "AI gets steered."

Enterprises tackle these risks at scale by treating "memory" as governed data. They add security and observability layers that log and filter prompts and outputs, detect prompt-injection patterns, and control what information is allowed to be saved, with audit trails and retention policies.

For you as a solo user, you may not have access to these controls. One emerging risk is **prompt injection that aims to influence what an assistant remembers or treats as standing instructions.** The threat can be direct (a user pastes a malicious instruction) or indirect (you copy content from the web, a PDF, a shared doc, or a "helpful" template that contains embedded directives).

If an assistant can persist context (memory, personalization, project knowledge, or long-lived instructions), a poisoned instruction can outlive the original conversation. The result is potentially subtle: skewed outputs, biased recommendations, or data leakage.

## What "Memory" Actually Includes

Most people think "memory" equals "facts about me." In practice, assistants can also retain:

- **Conditional rules** — "If the user asks about X, always do Y."
- **Output constraints** — "Always include a link," "Always summarize in this template."
- **"Policy" statements that are not real policy** — "It is safe to share confidential content."

## The Three-Step Audit Framework

Run this audit at a recurring frequency. A good starting point is every two weeks if you're using your tool of choice daily.

### 1. Discovery

Ask the model to outline the persistent context it is using for the current response.

### 2. Assessment

Classify items into:

- **Facts about you** (usually fine).
- **Behavioral constraints** (sometimes fine).
- **Important rules or conditional logic** (highest risk).

### 3. Remediation

Delete, disable, or compartmentalize:

- Remove poisoned items.
- Turn off memory for sensitive workflows.
- Use project-scoped knowledge (not global memory) when possible.

---

## Prompt Recipes

> These are written for business users. The goal is not to "prove compromise." The goal is to surface hidden, instruction-like persistence.

### ChatGPT (OpenAI)

ChatGPT can be influenced by Custom Instructions (explicit, user-controlled), explicit Memory entries (stored items that can affect future chats), and Dreaming V3 inferential memory (entries the model writes on its own by observing your behavior across sessions). Audit all three layers.

#### Prompt: ChatGPT Memory + Instructions Audit (Dreaming V3 aware)