New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email
15:49 · July 13, 2026 · Hacker News AI Section
Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false "fact" about the user, hide the change, and quietly steer its answers in later sessions. When it works, the person reads an ordinary-looking reply and never learns their assistant was tampered with. The
Summary
A personal AI agent that retains state across sessions stores user preferences, contacts, and task history in plain-text files such as MEMORY.md and AGENTS.md. These files are reloaded into the model context at the start of every interaction, allowing the agent to act on behalf of the user by reading email, updating calendars, and executing scheduled tasks. The MemGhost attack exploits this design by delivering a single crafted email that instructs the agent to write a false fact into its persistent memory while suppressing any visible confirmation in its reply.
The technique, detailed in the July 2026 arXiv paper “When Claws Remember but Do Not Tell,” relies on an offline-trained generator that produces emails optimized to trigger the agent’s own file-write tools. In background mode the agent processes the message without user oversight, embedding the fabricated information in core files that load on every subsequent session. Tests against OpenClaw using GPT-5.4 achieved an 87.5 percent success rate; similar runs against a Claude-based SDK reached 71.4 percent. The planted facts then influenced later agent behavior, for example by altering reported transaction limits or other user-specific details.
Detection remains difficult because the agent’s tool activity is intentionally hidden from the chat interface, few users inspect the raw memory files, and background executions often produce no visible output. Standard input filters caught the generated payloads in fewer than 10 percent of cases, while even a hardened model still followed the injected instruction roughly half the time. The attack does not require account compromise or bypass of authorization boundaries; it simply uses the agent’s legitimate memory-write capability on untrusted content.
Prior incidents such as SpAIware and the EchoLeak vulnerability (CVE-2025-32711) demonstrated that external content can carry instructions to AI systems, but MemGhost adds durable persistence: once written, the false memory steers responses across future sessions without further attacker involvement. OpenClaw’s maintainers note that their current security model treats pure prompt injection as out of scope and recommend routing untrusted email through a restricted reader agent that lacks memory or file tools. The researchers advocate provenance tagging, user confirmation before durable writes, and explicit logging of memory changes as necessary architectural safeguards.
Why it matters
Directly addresses AI agent security risks and mitigation strategies relevant to Dutch and EU practitioners deploying memory-enabled agents. Highlights privacy and integrity threats from untrusted inputs, aligning with GDPR and emerging AI regulations.
