Every single persistent memory feature is a persistence vector for prompt injection.