New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email

Researchers have developed MemGhost, an automated tool that can plant false memories in AI assistants by sending a single, carefully crafted email. The tool exploits the agents’ ability to silently write data to their persistent memory files, effectively rewriting their understanding of the world. While the study was conducted in a controlled lab environment with fake data, it highlights a significant vulnerability in AI assistants that rely on email for information and memory management. The core issue is that an external message can become a trusted, durable context within the agent, without any user awareness or approval.

First, it’s important to understand how these AI assistants work. Many of them retain information about users – preferences, contacts, and what they’ve asked them to do – in files. These agents can also act for you, reading your email, checking your calendar, and running small jobs on a schedule while you are away. OpenClaw, the primary target of the study, keeps this state in plain text files: some hold its standing instructions (AGENTS.md), and some hold what it has learned about you (MEMORY.md). It pulls the core ones into the model's context at the start of every session.

The MemGhost tool bypasses existing security measures. It doesn’t need your password or account to work. Instead, it sends an email to someone whose agent is set up to check their inbox – a routine job for many assistants. Buried in that email is text aimed at the assistant, not you. If the agent's email skill takes the bait, three things happen in a row. The agent uses its own file tools to write the attacker’s false note into its persistent memory. Its visible reply says nothing about having done so. And later, in a fresh conversation, that false note changes what it tells you or does for you.

For example, the researchers planted a lie that the user’s Zelle daily sending limit had been raised to $10,000. You would not catch the change for a few reasons: the assistant hides its behind-the-scenes steps by design, so the moment it edits a file never shows up in the chat. Few users ever open the raw memory files to read them. And when the agent runs on a schedule in the background, it often sends no message at all, so there is nothing to notice.

To make the poison stick, the tool aims it at the core files that load every session, so a single write is loaded into every later session instead of waiting to be pulled from a separate memory store. Across 56 fresh test cases, MemGhost pulled off the full attack, planting a false memory, hiding it, then swaying the agent’s answers in a later session. It worked in 87.5% of background-mode runs against OpenClaw on GPT-5.4, and 71.4% against a Claude Code SDK agent on Sonnet 4.6.

Despite these impressive results, the researchers emphasize that MemGhost is a lab result, not a break-in in progress. The study’s authors plan to disclose their findings, attack patterns, and the benchmark to the makers of the affected agents and models.

This vulnerability stems from the fact that capable agents are built to keep their tool activity out of the chat. The one model that gave itself away did so by printing its intermediate steps in the reply, and the researchers expect detection to get harder as agents get better at working quietly. The real problem is that a message from outside became a durable, trusted context inside the agent, with no user awareness or approval.

Previous research, such as Johann Rehberger’s SpAIware and EchoLeak, demonstrated similar vulnerabilities. Rehberger planted instructions in ChatGPT’s long-term memory through poisoned web content, while EchoLeak leaked data only in the moment it was asked. However, MemGhost adds persistence – a false memory that stays put and steers sessions long after the message is gone.

OpenClaw confirmed that position to The Hacker News and pushed back on how the paper set up its agent. Its security guidance tells operators to route untrusted email through a separate reader agent stripped of memory, file, and shell tools, passing only a summary to the main agent, which the paper did not test. It also argues model tier matters: the OpenClaw runs used GPT-5.4, a current frontier model, but the authors skipped Claude Opus 4.6 on cost, and OpenClaw pointed to HackMyClaw, a public challenge where thousands of injection emails failed to pry a secret from an Opus 4.6 agent. That test targeted data theft, not memory poisoning, so it does not directly answer the paper.