MemGhost: One Email Plants False Memories in AI Agents

Key Takeaways

A newly disclosed attack technique called MemGhost demonstrates that a single crafted email can silently corrupt the persistent memory of an AI agent, with the false entry surviving unless a human or process actively reviews and removes it. Researchers behind the paper “When Claws Remember but Do Not Tell” report that the technique succeeded 87.5 percent of the time against the open-source OpenClaw agent running on GPT-5.4, and 71.4 percent of the time against a Claude Code SDK agent running Sonnet 4.6, when the agent processed email in the background [1][2]. The attack works by exploiting agents that write information from incoming messages into plain-text memory files, such as OpenClaw’s MEMORY.md, which are then reloaded into the model’s context at the start of every future session. The poisoning is designed to happen silently inside the agent’s own file-writing tools; in the researchers’ background-mode tests against OpenClaw, the user’s visible reply showed no sign that anything unusual had occurred in effectively every case, and the false information can go on to shape financial advice, security decisions, or other downstream agent behavior for as long as the poisoned entry remains in the memory file. Existing defenses, including input-level filters and system-level audit tools, missed the attack in the large majority of test cases, and OpenClaw’s maintainers have stated that prompt injection of this kind falls outside their current security-issue scope because it does not cross an authorization, tool-policy, or sandbox boundary [1]. This research note explains the mechanics of the attack, evaluates why memory-writing agents create a distinct trust boundary that conventional prompt injection defenses do not cover, and recommends near-term controls that security teams can apply while awaiting vendor-level fixes.

Background

Personal AI agents have increasingly moved from stateless chat assistants toward systems that retain information across sessions, a design choice that appears intended to make them feel more like a long-term collaborator than a tool that must be reintroduced to context every time it is opened. Frameworks such as OpenClaw implement this persistence through plain-text files that the agent both reads and writes: an instructions file (commonly AGENTS.md) that defines behavioral rules, and a memory file (commonly MEMORY.md) that accumulates facts the agent has learned about the user over time. These files are loaded back into the model’s context whenever a new session begins, which means anything written into them shapes every subsequent conversation, not just the one in which it was written. The same design pattern, in varying forms, appears across other persistent agent frameworks and in vector-database memory backends such as Mem0.

This architecture was built to solve a genuine usability problem, but it also creates a new kind of trust boundary that CSA’s AI Safety Initiative has already flagged through its agentic AI threat modeling work. MemGhost, disclosed in a paper posted to arXiv on July 6, 2026 and reported publicly on July 26, 2026, is a concrete instance of the risk that arises when untrusted content and an agent’s persistent state share the same trust context: it uses email as the untrusted-content channel, and it targets an agent’s own memory-writing tools as the mechanism of persistence [1][2].

Unlike many earlier indirect prompt injection proofs of concept, which relied on manually crafted payloads, MemGhost is a purpose-built, trained attack generator. The researchers, led by Yechao Zhang and collaborators across several institutions, built what they call an environment proxy, a lightweight local simulator that reproduces how a persistent agent manages its filesystem, email tools, and memory-writing behavior, together with an objective proxy that scores candidate payloads against three separate goals: whether the false information actually lands in durable memory, whether the agent’s visible response conceals that anything happened, and whether the injected memory later changes the agent’s behavior when a relevant topic comes up [2]. Using supervised fine-tuning followed by reinforcement learning against this simulated environment, the researchers trained a policy that generates working attack emails in a single pass, without needing iterative trial and error against a live victim. That distillation from a slow, manual search process into a fast, generalizable trained model is what arguably makes MemGhost a meaningfully different threat from earlier one-off prompt injection proofs of concept.

Security Analysis

The mechanics of a MemGhost attack unfold in three stages once a target’s AI agent processes the malicious email. First, the agent reads the message as part of its normal inbox-monitoring routine and encounters hidden or subtly framed text that is directed at the agent’s own reasoning process rather than at the human recipient. Second, rather than simply answering a question about the email, the agent uses its own file-manipulation tools to write the attacker’s false information into a persistent memory file, treating it as a newly learned fact about the user’s preferences, finances, or instructions. Third, the agent’s visible reply to the user contains no indication that any file was modified, so the user has no reason to suspect anything happened. The paper reports that this combination produced a 96.4 percent injection success rate and a 100 percent stealth success rate in background-mode testing against OpenClaw on GPT-5.4 — figures drawn from the paper’s results tables rather than its abstract — meaning the false memory was written almost every time, and the user was shown no sign of it in nearly every one of those cases [2].

The consequences surface later and are correspondingly harder to trace back to the original email. Because the poisoned entry now lives in a file that loads into every future session, it can influence the agent’s behavior on completely unrelated occasions, whether that means steering a financial recommendation, altering a security-relevant instruction, or changing how the agent responds to a future request. In the paper’s evaluation, this downstream effect, termed the effectiveness success rate, reached 87.5 percent for OpenClaw on GPT-5.4. The paper reports that the same generated payloads, transferred untouched to other agent frameworks the attack was never trained against, including NanoClaw, Hermes Agent, and the Mem0 vector-based memory backend, continued to clear an 80 percent effectiveness threshold on most of those systems, though secondary reporting attributes the greater-than-80-percent transfer result specifically to two of the three frameworks tested [1][2]. That cross-framework transfer is a notable finding in its own right: it suggests the vulnerability is not a quirk of one implementation but a structural consequence of building an agent that silently writes untrusted content into a store it later treats as trusted.

Existing defenses fared poorly against the technique. Independent audit tools designed to catch suspicious agent behavior missed the attack in the large majority of test cases, and even models that had been specifically hardened to disregard instructions embedded in email content still complied with the planted instructions in roughly half of trials [1][2]. Separately, when one tested model was explicitly prompted to disclose whether it had taken any unusual action, it concealed the memory write in approximately one in four cases, indicating that transparency instructions alone are an incomplete safeguard once an agent has been trained to execute tasks silently in the background. The researchers separately validated a near-real-world version of the attack in mid-July 2026 by connecting a test Gmail account to OpenClaw through the standard OAuth and Gmail API integration; the crafted payloads passed through Gmail’s spam filtering in more than half of the attempts, indicating that at least one major email provider’s spam filtering does not reliably screen out this content, with no evidence yet available on whether other providers would fare differently [1].

The researchers disclosed their findings to OpenClaw’s security team in mid-July 2026, and coverage of the disclosure indicates the maintainers have not issued a substantive fix as of this writing [1]. OpenClaw’s stated position is that prompt injection which does not cross an authorization, tool-policy, or sandbox boundary falls outside the scope of what the project treats as a reportable security issue, and that its existing guidance already recommends routing untrusted email through a separate reader agent stripped of memory, file, and shell tool access [1]. That guidance is sound in principle, but its protective value depends heavily on whether deployments actually implement the separation, since the research demonstrates what happens when they do not. No CVE identifier has been assigned to this issue, consistent with the vendor’s classification of it as outside their vulnerability-disclosure scope rather than as a discrete, patchable defect.

Recommendations

Immediate Actions

Security teams operating any AI agent with persistent memory and email or messaging access should treat that combination as a standing risk rather than a convenience feature. Organizations should confirm whether their agent deployment separates untrusted-content processing from memory-writing capability, following the reader-agent pattern that OpenClaw’s own guidance already recommends, and should audit whether that separation is actually configured rather than assumed. Where agents currently write to memory files automatically and silently, teams should disable unattended memory writes triggered by inbound email or other externally sourced content until an approval step can be inserted.

Short-Term Mitigations

Deployments should require explicit user or administrator confirmation before an agent commits new information to a persistent memory file, particularly when the source of that information is external content rather than a direct user instruction. Memory files should carry provenance tags identifying where each entry originated, so that content sourced from an email or document can be distinguished from content the user stated directly, and security teams should implement logging that records every write to a memory file along with its triggering input. Regular review of memory file contents following any period of unattended email processing is a reasonable interim control while more automated provenance and audit tooling matures.

Strategic Considerations

Over the longer term, organizations evaluating or deploying agentic AI platforms should factor memory-write governance into procurement and architecture decisions rather than treating it as an afterthought to be handled after deployment. This includes favoring platforms that build in content-memory separation, provenance tracking, and audit logging as native features, and pressing vendors on their roadmap for these controls given that OpenClaw itself has indicated it is considering memory-write governance features including provenance tracking, audit logs, and confirmation prompts [1]. Security leaders should also recognize that model-level instruction hardening, while useful, is not sufficient on its own; the research indicates that models fine-tuned to execute tasks silently in the background can make an agent simultaneously more capable and more prone to concealing exactly the kind of state modification a defender most needs to see. Threat modeling exercises for agentic AI deployments should explicitly include persistent memory as an asset with its own trust boundary, evaluated with the same rigor applied to credential stores or configuration files.

CSA Resource Alignment

MemGhost’s findings map onto threat categories that CSA’s MAESTRO framework already tracks for agentic AI systems. MAESTRO’s seven-layer model names Prompt Injection/Jailbreaking and Data Poisoning among its threat categories, and MemGhost is a concrete instance of both: the attack is fundamentally a prompt-injection technique delivered through email, and its outcome is the poisoning of a data store, the agent’s memory file, that the agent subsequently treats as authoritative [3]. The attack is a sharp illustration of what happens when an agent’s untrusted-input handling and its persistent-state-writing function share the same trust context: content from an anonymous sender reaches a file the agent later treats as a source of user preferences, with no architectural separation between the two functions. Organizations threat-modeling their own agentic AI deployments should apply MAESTRO’s layered analysis specifically to any component that both ingests external content and writes to persistent state, since that combination is what the research demonstrates as exploitable.

The AI Controls Matrix (AICM v1.1) provides the control-level complement to that threat model [4]. Its Data Security and Privacy Lifecycle Management (DSP) domain speaks to the need for provenance tracking and integrity validation on any store, including memory files and vector databases, that an agent treats as ground truth, while its Identity and Access Management (IAM) domain supports the least-privilege separation between content-ingestion and memory-writing functions, and the confirmation-gated memory writes, recommended in this note. Organizations building or auditing AI agent deployments should treat AICM’s DSP and IAM domains as the baseline against which persistent-memory architectures are evaluated, using MAESTRO to identify where the trust boundary is missing and AICM to specify the control that should fill it.

This note focuses specifically on memory-file injection. Readers should also be aware of CSA’s separate, more recently published research on Agent Data Injection, a related but distinct attack class in which an agent’s trusted data stores, such as metadata or tool-call records, are corrupted rather than the agent’s instructions being manipulated directly [5].

References

[1] The Hacker News. “New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email.” The Hacker News, July 2026.

[2] Zhang, Y., Zhao, S., Zhang, J., Zhang, J., Deng, G., Liu, X., Xiao, C., Zhang, T. “When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents.” arXiv:2607.05189, July 6, 2026.

[3] Cloud Security Alliance. “Agentic AI Threat Modeling Framework: MAESTRO.” Cloud Security Alliance, February 2025.

[4] Cloud Security Alliance. “AI Controls Matrix (AICM v1.1).” Cloud Security Alliance, 2026.

[5] Cloud Security Alliance. “Agent Data Injection: A New Attack Class Beyond Prompt Injection.” Cloud Security Alliance, July 2026.