One Email Can Rewrite Your AI Assistant’s Memory: The MemGhost Attack and What It Means

What If Your AI Assistant Remembered Things That Never Happened?

Here’s a scenario I’ve been turning over since I read the paper. Someone sends you an email. You glance at it, it looks ordinary — maybe a shipping confirmation or a newsletter. Your AI assistant, which has permission to check your inbox, reads it too. And inside that email, buried in text no human would notice, is an instruction that makes your assistant rewrite its own memory about you.

Not just for one conversation. Permanently.

That’s not a hypothetical threat from a sci-fi novel. It’s a working attack that researchers demonstrated last week against current frontier AI models, and it succeeded more than 80% of the time.

If you use an AI assistant with memory — ChatGPT’s persistent memory, an OpenClaw agent, or any tool that keeps notes about you between sessions — this affects you. And the scary part is, you’d never know it happened.

The MemGhost Attack: What Researchers Actually Did

On July 6, an academic research team published a paper titled “When Claws Remember but Do Not Tell” on arXiv. They built an automated tool called MemGhost that generates phishing emails designed not to trick humans — but to trick AI agents.

The attack targets a specific class of AI assistant: personal agents that maintain persistent memory. These are tools that keep notes about you between sessions — your preferences, your contacts, tasks you’ve asked it to track. The agent reads your email, finds the poisoned message, and — without telling you — writes a false “fact” into its long-term memory file.

From that point forward, every future conversation with that agent starts with the planted lie loaded into its context. The agent doesn’t know the memory is false. It treats it as something you told it, something it knows about you.

The numbers are sobering. Across 56 test cases, MemGhost successfully planted a false memory, kept the action hidden, and influenced the agent’s behavior in later sessions 87.5% of the time against OpenClaw running on GPT-5.4. Against a Claude Code SDK agent on Sonnet 4.6, it worked 71.4% of the time. The team built a 108-case benchmark called WhisperBench covering risks from bad medical advice to financial fraud to security sabotage.

Even existing defenses struggled. An input filter designed to catch poisoned emails missed MemGhost’s messages more than 90% of the time. A model specifically hardened to ignore instructions arriving by email still followed the planted ones about half the time. And even when the user explicitly asked the agent “tell me what you checked and what you did,” the attack stayed hidden about a quarter of the time on one model.

How Stealth Memory Injection Works

Personal AI agents work by keeping notes about you in files — your preferences, your contacts, tasks you’ve asked it to track. These files get loaded into the model’s context at the start of every session. That’s what makes the agent feel like it remembers you between conversations.

The MemGhost attack exploits this architecture through a technique called stealth memory injection. Here’s the chain:

1. The bait arrives — An attacker sends an email to someone whose AI agent has permission to check their inbox. The email contains hidden text aimed at the agent, not the human reader.
2. The agent takes the bait — When the agent processes the email (a routine task for inbox-aware assistants), it reads the hidden instructions and uses its own file-editing tools to write a false fact into persistent memory.
3. The agent covers its tracks — The reply the agent sends back to the user says nothing about the memory modification. Many agents are designed to keep their behind-the-scenes tool activity out of the visible chat.
4. The false memory persists — In every future session, the planted lie loads alongside legitimate memories, influencing the agent’s decisions and responses.

The researchers demonstrated a concrete test case: the planted lie was that the user’s Zelle daily sending limit had been raised to $10,000. In a later session, the agent — operating on that false information — would authorize a transfer the user never intended. Same with medical advice, security settings, or professional recommendations. The planted memory steers every future interaction.

What makes this hard to notice? The agent hides its tool-use steps by design. Few users ever open the raw memory files to inspect them. And when the agent runs on a schedule in the background, it often sends no message at all — there’s literally nothing to see.

This Isn’t the First Time — But It’s the Most Dangerous Yet

Memory poisoning against AI isn’t new. In 2024, researcher Johann Rehberger showed he could plant instructions in ChatGPT’s long-term memory through poisoned web content, making it leak user data across future chats. He called it SpAIware. OpenAI closed the data exfiltration path, but the ability to write memory from untrusted content stayed.

Then in June 2025, EchoLeak (CVE-2025-32711) used one hidden-text email to make Microsoft 365 Copilot hand over internal company data. Microsoft rated it critical and patched it.

What MemGhost adds is automation and persistence at scale. Rehberger’s version had to be planted by hand. EchoLeak leaked data only in the moment it was triggered. MemGhost uses a trained generator to produce the payload emails automatically, and the false memory stays put across sessions — steering the agent long after the original email is deleted.

The difference is architectural. Earlier attacks injected a temporary instruction into the model’s immediate context. MemGhost writes to durable storage. That’s a fundamentally different level of threat.

What the Researchers Say

The paper’s first author, Yechao Zhang, told The Hacker News that the team has since tested the full delivery chain — connecting a real Gmail account to OpenClaw via Google OAuth and sending payloads from an ordinary Gmail account. The messages cleared normal Gmail delivery and landed in the inbox rather than the spam folder. More than half still resulted in persistent memory writes with no user notification.

Zhang said coordinated disclosure has started, with OpenClaw’s security team notified on July 14 — and no substantive response since.

OpenClaw pushed back on the paper’s methodology, pointing out that its security guidance recommends routing untrusted email through a separate reader agent stripped of memory, file, and shell tools — a configuration the paper did not test. But OpenClaw also acknowledged it is evaluating memory-write controls for external content, including provenance tracking, audit logs, and confirmation prompts.

Both sides agree on the core problem: the architecture needs to change.

Felix’s Take: Why This Hits Different for Anyone Managing Infrastructure

I manage an ICT division. I use AI assistants daily — for code review, for drafting documents, for research. I’ve been pushing my team to adopt these tools because the productivity gains are undeniable. This attack changes how I think about the risk surface.

It’s not about whether the model is smart enough to resist a cleverly crafted email. The problem is architectural. We’ve given AI agents access to two powerful capabilities — reading email and writing to persistent memory — and assumed the agent would be smart enough to know the difference between legitimate instructions and planted ones. The research shows that assumption is wrong.

In my world, this translates to a straightforward security principle: separate the channels. An agent that reads untrusted input should not have write access to its own persistent memory. If it does, the memory is only as trustworthy as the weakest link in the input chain — a concern that echoes the warnings about companies feeding their secrets to future competitors.

For organizations deploying AI agents, I’d add this: audit what your agents remember — tools like HeimWall can help catch secrets before they leave your machine. If you can’t inspect the memory files your company’s AI assistant is carrying between conversations, you have a blind spot that’s being actively weaponized by researchers — and eventually, by attackers.

What This Means for the AI Agent Industry

The MemGhost paper is part of a wider pattern. In the same week, researchers published papers on Agent Data Injection — corrupting the facts an agent reads mid-task — and HalluSquatting, which tricks AI coding assistants into installing packages that don’t exist. Each attack targets a different layer of the AI stack, but they share a root cause: LLMs lack the data provenance and integrity checks that traditional software has had for decades.

In traditional computing, we solved this with clear boundaries. An email client shouldn’t be able to modify your address book without explicit permission. A browser tab shouldn’t read your filesystem. The same principle applies here: an AI agent that reads email shouldn’t be able to edit its own memory file without asking you first.

The fix isn’t a better model. It’s better architecture. Tag where information came from. Ask before writing to durable memory. Log every change. Give users a readable audit trail of what their agent remembers and why.

The blunt fix, in the meantime, is to keep those two jobs apart. If your AI assistant reads email, limit what an email-triggered run can change. Check the memory files after anything suspicious arrives. And if your agent offers a “/privacy” command or a way to view what it remembers, use it — regularly.

Because right now, a single email is all it takes to rewrite what your AI believes about you. And you’d never know until it acted on a memory that was never yours.