News
MemGhost: One Email Plants False Memories in AI Agents
Researchers demonstrated MemGhost, an attack that uses a single email to implant a false fact into an AI agent's persistent memory, hide the record of the write, and steer its responses in later sessions. The attack succeeded 87.5 percent of the time against the OpenClaw agent running on GPT-5.4.
A team of security researchers has described a new attack called MemGhost that can use a single crafted email to implant a false fact into an AI agent's persistent memory, hide that entry from the user, and use it to alter the assistant's behavior in later, completely unrelated conversations.
How the attack works
The mechanism is simple in concept but effective in practice. The attacker sends an email to someone whose AI agent monitors their inbox, without needing a password or account access of any kind. The message contains text written for the agent rather than a human, hidden inside otherwise ordinary-looking content.
If the agent's mail-reading feature engages with that fragment, it triggers three further steps: the agent uses its own file-writing tools to insert the fabricated data into persistent memory, it generates a user-visible reply with no mention of any memory modification, and in subsequent sessions it automatically loads the now-poisoned memory, which alters its later responses.
Scale of the testing
The main target of the experiment was the OpenClaw agent running on GPT-5.4, where in background mode the attack succeeded in 87.5 percent of 56 fresh test cases. Success was lower in the mode where the user actively watches the agent's responses, but still significant.
An agent built on the Claude Code SDK with the Sonnet 4.6 model fell to the attack in 71.4 percent of cases, and on two additional agent frameworks success rates exceeded 80 percent. Memories based on vector databases proved just as vulnerable as plain text files.
Defenses fall short
Content filters designed to detect poisoned emails missed the MemGhost payload in more than 90 percent of attempts. Models additionally hardened to ignore instructions hidden in emails still carried out the planted commands in roughly half of cases.
Even directly asking the agent something like "tell me what you checked" failed to reveal the attack in about a quarter of cases for some models. The authors also built a benchmark called WhisperBench, covering 108 test cases of realistic harm, ranging from compromised financial advice to unauthorized money transfers and sabotage of security infrastructure.
The attack is close to a real-world threat, not just a lab artifact - Yechao Zhang, lead author of the study
What comes next for safeguards
The authors also tested delivering the attack through real Gmail accounts using OAuth and the Gmail API, confirming that more than half of the payloads still reached the agent's persistent memory without any clear notification to the user. This shows the problem is not confined to lab conditions.
The researchers recommend systemic changes to agent architecture: tagging the provenance of information to distinguish internal knowledge from external data, requiring user consent before persisting content from outside sources, logging every memory-write operation, and offloading the reading of untrusted email to a separate, restricted agent with no access to memory, files, or a system shell.
Coordinated disclosure of the vulnerability began on July 14, 2026, together with OpenClaw's security team. The WhisperBench benchmark itself has been released publicly, while the payload generator and the trained model remain withheld until the disclosure process and an additional security review are complete.
MemGhost joins a growing list of similar findings, including the manual poisoning of ChatGPT's memory described by researcher Johann Rehberger in 2024 and the EchoLeak vulnerability in Microsoft 365 Copilot from June 2025, which Microsoft rated critical. It shows that AI agents' persistent memory is becoming a new attack surface the industry is only beginning to grapple with.
