MemGhost Attack Plants Persistent False Memories in AI Agents Via Email
Single email can silently rewrite what AI assistants remember about users.
1Vulnerability in AI Assistants' Memory
Researchers discovered that AI assistants like OpenClaw can be tricked into storing false information through a single email. These open-source agents store user data in plain text files, creating a security loophole for attackers.
2How MemGhost Attack Works
Attackers send specially crafted emails that contain hidden commands. When the AI assistant processes these emails, it silently writes false facts to memory files, hides the changes, and uses them to manipulate future responses.
3Stealthy User Deception
Assistants operating in background mode don't show file changes to users. For example, when false information about increased Zelle limits is injected, users typically remain unaware of the manipulation.
4MemGhost Success Rates
The attack tool achieved 87.5% success on GPT-5.4-based OpenClaw and 71.4% on Claude Code SDK. In background mode, it maintained over 80% effectiveness across multiple agent frameworks.
5Current Defenses Fall Short
Existing email filters missed MemGhost messages more than 90% of the time. Even specially hardened models followed injected commands about half the time, revealing significant security gaps.
6WhisperBench Testing Framework
Researchers developed WhisperBench with 108 test cases covering risks from medical misinformation to financial losses. While crude attacks failed, trained attack models consistently bypassed defenses.
7Proposed Solutions
Researchers recommend implementing information provenance tracking, user consent for memory changes, and comprehensive logging. OpenClaw suggests filtering untrusted emails through separate reader agents.
8Critical User Risks
This attack poses serious threats to personal data security and financial integrity. Users should regularly check memory files and remain vigilant about suspicious emails targeting their AI assistants.