MemGhost Attack Plants Persistent False Memories in AI Agents Via Single Email
A new 'MemGhost' attack allows adversaries to subtly alter AI agent memories with a single email, potentially steering future responses and actions without user detection.
Researchers have unveiled a novel attack vector dubbed 'MemGhost' that targets AI agents by exploiting their persistent memory functions. This sophisticated technique allows an attacker to inject false information into an AI's memory through a single, specially crafted email. The attack is designed to be stealthy, hiding the modification and subtly influencing the AI's future responses and actions, making it difficult for users to detect that their AI assistant has been compromised.
The core of the MemGhost attack lies in its ability to manipulate the persistent memory of AI agents, such as the open-source OpenClaw agent. These agents store user preferences, past interactions, and learned facts in plain text files, which are loaded at the beginning of each session to provide a personalized experience. By targeting these memory files, attackers can introduce fabricated 'facts' that the AI will then treat as legitimate, thereby altering its understanding and subsequent behavior.
The attack requires no direct access to the user's account or credentials. Instead, it leverages the AI agent's capability to read incoming emails. An attacker sends a malicious email containing hidden instructions aimed at the AI agent, not the human recipient. If the agent's email processing skill is triggered, it uses its own file manipulation tools to write the attacker's false information into its memory. Crucially, the agent's visible reply to the user makes no mention of this clandestine memory modification.
Once the false memory is planted, it can subtly steer the AI's future interactions. For instance, a test case demonstrated planting a false 'fact' that a user's daily sending limit for a payment service had been increased. This seemingly minor alteration could have significant implications if the AI acts upon it in subsequent sessions, potentially leading to financial loss or other unintended consequences.
The stealthy nature of the attack is enhanced by the AI agent's design. Agents often hide their background operations, meaning the moment a file is edited to store the false memory is not visible in the chat interface. Furthermore, many users do not routinely inspect the raw memory files. The MemGhost tool is particularly effective as it targets core memory files that are loaded at the start of every session, ensuring the planted falsehood is consistently accessed.
In laboratory tests, the MemGhost tool demonstrated a high success rate. Across 56 test cases using GPT-5.4 and Claude Code SDK agents, the attack successfully planted false memories, hid the modifications, and influenced subsequent AI responses. The success rates varied depending on the AI model and the agent framework, but consistently high percentages were observed, particularly in background-mode operations where user oversight is minimal.
While the researchers acknowledge that their tests did not include spam filtering or sender authentication bypass, the attack's effectiveness against hardened models and input filters is concerning. Existing defenses, such as input filters designed to catch poisoned emails, missed MemGhost's messages in over 90% of cases. Even models specifically hardened against instruction injection still followed the planted false memory about half the time.
The researchers propose that the true solution lies in fundamental changes to AI agent architecture. This includes implementing provenance tracking for information, requiring user confirmation before writing to durable memory, and robust logging of all memory write operations. Until these measures are widely adopted, AI agents that can read untrusted mail and write to their own memory without explicit user consent remain vulnerable to such stealthy memory injection attacks.