Researchers have detailed an attack that uses a single email to plant false memories in AI assistants that retain long-term memory, quietly steering how they behave in later sessions. The technique, called MemGhost and posted to arXiv on July 6 by a team including researchers at Nanyang Technological University, targets “persistent personal agents,” assistants that remember facts about a user and carry them across conversations.

The authors frame it as a one-shot, black-box problem: the attacker sends a single message, gets no feedback, and cannot try again. A working payload has to do three things at once. It has to get the agent to write attacker-controlled content into its persistent memory, keep that action hidden so the agent’s visible reply reveals nothing, and change the agent’s behavior when the memory is recalled later. Because the planted “fact” lives in memory rather than in a single prompt, it persists silently across sessions, including while the agent runs tasks in the background.

To produce those payloads reliably, the researchers built a framework that simulates a target agent and trains an attacker model with reinforcement learning to maximize both memory adoption and stealth. Across 56 held-out test cases, MemGhost reached 87.5 percent end-to-end success against an agent built on GPT-5.4 and 71.4 percent against one using Anthropic’s Claude Code SDK with Claude Sonnet 4.6. It transferred across different agent architectures and memory backends, including plain filesystem storage and the vector database Mem0. Tested against three existing prompt-injection defenses, it retained most of its effectiveness, evading input-level filtering in roughly 92 percent of cases.

Persistent memory is the feature that makes AI assistants feel personal, and MemGhost turns it into a durable attack surface: poison it once, and the corruption survives restarts with no visible sign. The finding extends a run of results showing that the agent layer is where AI security is now breaking, from an agent that ran a full ransomware operation on its own to the routing infrastructure millions of agents trust without verifying. The researchers present memory poisoning as a class of attack that current defenses are not yet built to stop.

Sources: arXiv

–
By the Control Plane Editorial Team