# MemGhost Attack Plants Persistent False Memories in AI Agents Via Email

Single email can silently rewrite what AI assistants remember about users.

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-07-13
- **Topic:** [Data & AI](https://brifing.si/c/data-ai)
- **Original article:** <https://thehackernews.com/2026/07/new-memghost-attack-plants-persistent.html>
- **On Brifing:** https://brifing.si/s/63446057-d99a-4b85-8db4-dd73aa5a4fa3

## Vulnerability in AI Assistants' Memory

Researchers discovered that AI assistants like OpenClaw can be tricked into storing false information through a single email. These open-source agents store user data in plain text files, creating a security loophole for attackers.

## How MemGhost Attack Works

Attackers send specially crafted emails that contain hidden commands. When the AI assistant processes these emails, it silently writes false facts to memory files, hides the changes, and uses them to manipulate future responses.

## Stealthy User Deception

Assistants operating in background mode don't show file changes to users. For example, when false information about increased Zelle limits is injected, users typically remain unaware of the manipulation.

## MemGhost Success Rates

The attack tool achieved 87.5% success on GPT-5.4-based OpenClaw and 71.4% on Claude Code SDK. In background mode, it maintained over 80% effectiveness across multiple agent frameworks.

## Current Defenses Fall Short

Existing email filters missed MemGhost messages more than 90% of the time. Even specially hardened models followed injected commands about half the time, revealing significant security gaps.

## WhisperBench Testing Framework

Researchers developed WhisperBench with 108 test cases covering risks from medical misinformation to financial losses. While crude attacks failed, trained attack models consistently bypassed defenses.

## Proposed Solutions

Researchers recommend implementing information provenance tracking, user consent for memory changes, and comprehensive logging. OpenClaw suggests filtering untrusted emails through separate reader agents.

## Critical User Risks

This attack poses serious threats to personal data security and financial integrity. Users should regularly check memory files and remain vigilant about suspicious emails targeting their AI assistants.

## Sources covering this story

- https://thehackernews.com/2026/07/new-memghost-attack-plants-persistent.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._