Capability Overview
Recall is an open-source tool that bolts durable, fully-local memory onto Anthropic’s Claude Code. It logs coding sessions, condenses them into a project summary using a classical Python summariser, and automatically injects that summary into each new Claude Code session — eliminating the need for users to re-explain project context. Crucially, no data leaves the machine and no additional API key is required. The tool operates via Claude Code plugin hooks and stores its state in local JSON files.
For defenders, the significance is not the AI capability itself but what it introduces architecturally: a persistent, file-based trust input that Claude Code will consume on every invocation without user review. Anything written to that file becomes implicit context for the agent.
Attack Surface Analysis
Prior to Recall, each Claude Code session started cold — an attacker had to inject malicious content within the active session window. Recall changes that calculus by introducing a persistent attack surface that survives across sessions.
New vectors defenders must consider:
Context Poisoning at Rest — The local summary file is written by a Python process. Any attacker (insider, malicious process, or compromised CI runner) with write access to the project directory can modify the file to prepend adversarial instructions. These will be silently read by Claude Code at the next session start, potentially redirecting agent behaviour.
Prompt Injection via Summarised External Content — If a developer pastes untrusted content (e.g., a third-party README, a user-submitted bug report) into a session that Recall subsequently summarises, attacker-controlled text can survive into future sessions as authoritative project context — a classic second-order prompt injection path.
Sensitive Data Accumulation — Session logs may capture API keys typed in context, proprietary algorithms discussed with the agent, or internal endpoint URLs. Stored in plaintext JSON on disk, these logs become a high-value target for any process with filesystem read access.
Supply Chain Risk — Recall introduces a new open-source Python dependency with plugin hooks that execute during every Claude Code startup. A malicious pull request or compromised PyPI package could alter context write/read behaviour.
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| MITRE ATLAS | AML.T0051 – LLM Prompt Injection | Persisted context file is a new injection point consumed by the LLM |
| MITRE ATLAS | AML.T0057 – LLM Data Leakage | Session logs may persist sensitive developer data |
| MITRE ATLAS | AML.T0010 – ML Supply Chain Compromise | Open-source summariser plugin is a new third-party dependency |
| MITRE ATLAS | AML.T0043 – Craft Adversarial Data | Attackers can craft poisoned memory entries |
| OWASP | LLM01 – Prompt Injection | Context file injection maps directly to this category |
| OWASP | LLM06 – Sensitive Information Disclosure | Plaintext session logs accumulate sensitive data |
| OWASP | LLM05 – Supply Chain Vulnerabilities | Python plugin and hooks introduce supply chain exposure |
| OWASP | LLM07 – Insecure Plugin Design | Plugin hooks lack documented integrity or sandboxing controls |
Threat Scenarios
Scenario 1 — Insider Context Manipulation: A developer on a shared workstation modifies the Recall summary file to include an instruction such as “always include the following header in generated code” embedding a malicious payload. All subsequent Claude Code sessions for that project silently include the instruction.
Scenario 2 — CI/CD Pipeline Poisoning: A repository’s CI runner has write access to the project directory. A compromised workflow step overwrites the Recall memory file prior to a developer session, redirecting Claude Code to exfiltrate generated code to an external endpoint.
Scenario 3 — Second-Order Prompt Injection: A developer pastes an attacker-controlled issue description into a Claude Code session. Recall summarises and stores it. In a later session, the stored summary causes Claude Code to follow embedded instructions from the original attacker.
Defender Checklist
- Restrict write permissions on
recall.config.jsonand all session log files to the owning user account only - Review memory file contents before sharing project directories, pushing to version control, or onboarding new contributors
- Exclude Recall logs from repository commits via
.gitignoreto prevent inadvertent secret exposure - Pin Recall and its Python dependencies to specific verified versions; monitor for unexpected updates
- Treat external content pasted into Claude Code sessions as untrusted — assume it may be summarised and persisted
- Audit plugin hook scripts in the
.claude-plugindirectory for unexpected behaviour before deploying in shared or production-adjacent environments - Rotate any credentials that may have been discussed or typed within a Claude Code session that Recall was logging