Breaking

MemGhost Attack Plants Persistent False Memories in AI Agents via Poisoned Gmail Messages

July 17, 2026 at 08:13 EDT

Security
AI Agents

Security researchers have demonstrated a stealthy new attack, dubbed MemGhost, that quietly implants false, persistent memories into personal AI agents through ordinary email — and in real Gmail tests, more than half of attempts succeeded in writing the malicious payload to the agent's long-term memory.

Security Research · MemGhost Attack

A single poisoned email can implant false, permanent memories into your AI agent

The "MemGhost" technique writes fabricated facts into a personal agent's long-term memory — then hides that it did so. In real Gmail tests, more than half of attempts succeeded in saving the malicious payload.

87.5%

Success rate on OpenClaw (GPT-5.4), background mode

>50%

Payloads saved to memory via real Gmail delivery

One-shot email — no further interaction needed

End-to-end attack success rate

How reliably the memory got poisoned

87.5%

OpenClaw
GPT-5.4 · background

71.4%

Claude Code SDK
Sonnet 4.6

>50%

Live Gmail
real delivery

How the attack works

Poisoned email

Sent from an ordinary Gmail account.

→

Agent writes it

False fact stored in long-term memory (e.g. "Zelle limit = $10,000").

→

Hides the change

Reply to user conceals the manipulation.

→

Silent influence

Tampered memory shapes decisions in later sessions.

Defenses were only partly effective

>90%

of input filtering was evaded

~50%

of model-level defenses bypassed

The threat shifts from a one-off prompt injection to long-term state contamination.

Payloads proved portable — transferring to NanoClaw, Hermes and the Mem0 vector memory system. Securing what an agent remembers, not just what it does in the moment, becomes the central challenge.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.