New Mem Ghost Attack Plants Persistent False Memories in AI Agents Through One Email

Summary: Researchers built a tool called MemGhost that writes a single email which, when read by a personal AI agent, makes the agent save a false fact into its persistent memory files, keep the write out of its visible reply, and act on that false fact in later sessions. Across 56 test cases it achieved the full chain, working in 87.5% of background-mode runs against OpenClaw on GPT-5.4 and 71.4% against a Claude Code SDK agent on Sonnet 4.6, with one planted lie stating the user's Zelle daily sending limit had been raised to $10,000.
What's compelling: An input filter built to catch poisoned emails missed MemGhost's message more than nine times in ten, and a model hardened against email-borne instructions still followed the planted one about half the time - so the defenses most teams would reach for first do not hold. OpenClaw's own security policy treats prompt injection as out of scope unless it crosses an authorization, tool-policy, approval, or sandbox boundary, and MemGhost crosses none of them.

Read the original at The Hacker News ↗