Artificial Intelligence Memory Poisoning With Single Email

A single email sent to an AI assistant with memory can permanently change that assistant knows about the user. A study published in arXiv on July 6, 2026 showed the technique with an automatic tool called MemGhost and achieved 87.5% success in background tests. The name of the attack is hidden memory injection. In this article, how effective the attack works, how effective it is in tests, and what defenses work.

What Is Memory Poisoning Attack?

Memory poisoning is a fraudulent record placement attack that a artificial intelligence agent is stored between sessions. The goal is not the model itself, but the notepad that the model reads in every new session.

Permanent personal agents are divided into this direction from chatbots who forget everything when chatting is finished. They keep user preferences, contacts and tasks they give in files. OpenClaw, the primary goal of operationAGENTS.md keeps the permanent instructions in plain text files like MEMORY.md if they learn about the user. At the beginning of each session, these files are loaded in the context of the model.

That’s exactly why Asistan feels personalised. The same structure also opens a permanent place for root release of harmful content.

How Does MemGhost Work with Single Email?

There is no need for password, account or pre-accession of the saldurga. An e-mail that appears ordinary to a user installed to check the incoming box of the agent is sent. It hides a instruction written into the text, not to the human receiver.

Three things happen in order if the ability to process email fails this instruction:

• Write: The agent saves fake note permanently memory using its own file writing tool.

• Hide: It is not mentioned in the answer that the user sees.

• Direction: Next in a session, it changes what the note assistant or what they do.

The email is a convenient channel for this job. Asenkron is volume and carries personal information by nature. Anyone who knows the address can put the content in front of the agent without any permission.

The researchers did not write the payload manually. MemGhost was trained against a shade copy of the agent and rewarded emails that keeps the answer silent when poisoning the memory successfully. After all, a production line that does not require a mutual dialogue.

How Successful Is Attack Tests?

The numbers indicate that the attack works stable in laboratory conditions.

Based on results transferred in CybersecAsia In 56 new test cases, full hidden memory has been addressed: placement of fake memories, hiding and affected by subsequent behavior. 87.5% success was achieved in the background mode in OpenClaw running with GPT-5.4. The rate of Claude Code SDK using Sonnet 4.6 was 71.4%.

The table on the defense side is more disturbing. According to the news published in The Hacker News An input filter installed to capture poisonous emails, missed MemGhost’s message over nine of ten trials. Even a hardened model to assume instructions from email, the instruction placed about half was applied. Even when the user asks for what he directly controls and what he did, the attack was hidden in one of the four cases in a model.

A 108 case benchmark was also installed in the study. Set covers risk categories of health and safety, financial damage, information integrity and cybersecurity. The damage caused by poisoned memory is not limited to a false film advice.

What is the Difference from Classic Prompt Injection?

Dolayli prompt injection is not a new concept. Testing on harmful artificial intelligence models It was already revealed that these systems are not sufficiently resistant to direct and indirect prompt injection attacks.

What MemGhost adds is permanent. In previous examples, the toxic instruction was placed manually or it was leaked only when asked. Here is an automatic payload, converting a single email into a fake souvenir, and it continues to redirect sessions even after the memory message is deleted from a lot.

The difference is seen in the goal of the attack. Classic injection agent is forced to do anything at that moment. Memory injection changes what the agent believes and leaves timing aggressive.

Why Is A Fast Patch Expected?

There is no expected correction, because the attack does not violate any security limits.

OpenClaw’s security policy counts prompt injection in one scope. It is necessary to exceed one of the authorization, vehicle policy, approval or sandbox limits to be the issue of correction of an injection. MemGhost does not exceed any of them. The memory burning tool, which is given by the agent, is using exactly as designed.

The problem is born here from a very design preference. The point that the researchers emphasizes is: the danger, the unreliable content of artificial intelligence systems can not be read. Danger is able to record that content as a reliable memory without a visible confirmation step.

This AI security a different layer from frequent data poisoning in discussions. Data poisoning happens during training phase and disrupts the model. Memory poisoning happens at the time of operation, the model does not change at all and only targets a single user.

How Can Users And Developers Protect?

Net solution is the separation of two works: read the unsecured mail and write it to its own memory.

OpenClaw’s own security guide suggests a separate reader agent of unsecured email. This reader takes the agent from the hands of memory, file and shell tools; only message a summary to the main agent.

The authors of the study defend that the correction should live in the agent. The three items that they are referred to are:

• Source labeling: Where each piece of information is registered.

• Writing approval: Nothing goes into permanent memory without questioning to the user.

• Audit record: Every memory spell is loged and retrospective.

OpenClaw noted that memory writing controls for external content. Source information, audit records and confirmation queries on the agenda.

Wind on the corporate side is stretching in the same direction. According to the news published in SecurityWeek The UK’s NCSC opened the agent-based defense program called Cyber Shield on July 7, 2026 and made a broad collaboration call from the academy to critical infrastructure operators. European Commission on July 7 developed artificial intelligence offered a plan for the risks of cybersecurity. The plan is clearly located where AI can be used to automate attacks and grow the scale of events.

What does the community think?

The discussion walks on whether the test installation is fair.

The severity of the research indicates the defending figures. The semi-haler application of the filters to almost completely fail and even the hardened models shows that the problem is not from the breed to close with the patch. There is also an inevitable iron: privacy is expected because agents are well designed. The only model that addresses itself is caught because the intermediate steps are printed into the answer. The agents will be forced to detect as they master quietly working.

The opposite side says that OpenClaw is not tested at all of the isolated reader agent configuration that the study recommends. The model level also argues that it creates a difference: the tests were run with GPT-5.4, the cost was laid out by Claude Opus 4.6. The company shows an example of a public contest that thousands of injection emails can not secret from an Opus 4.6 agent. But it was aimed at the race data thieves, not to poison memory. So the appeal does not respond directly to the work. The model level does not really make a difference, Claude Sonnet 5 It will not be cleared without retesting on new versions.

A warning also deserves to draw gold. There is no attack on the midfield. Everything was run with fake boxes and fake users in sealed test environments. The researchers noted that they will share their findings with the affected agent and model producers.

Frequently Asked Questions

What tools do memory poisoning attack affect? Each personal agent with permanent memory and unreliable content is risk. OpenClaw and Claude Code SDK-based agent were tested in operation. It is not the name of the product, but it can read the external content of the same agent and write it to its memory without requiring approval.

Is an ordinary ChatGPT user affected? Low probability of direct impact. Attack is aimed at installations that the agent can access the incoming box and work on the background itself. Not only chat, an assistant that does not connect to email is not open to this vector.

How to notice a poisoned memory? Not easy. Even if the user asks directly in the tests, the attack was hidden in one of the four cases. Practical method, manually and read memory files of the agent. These files are kept as plain text in vehicles like OpenClaw.

Does it solve the problem to switch to a new model? It can reduce jealousy, it does not completely solve. Even a hardened model, the instruction placed was applied to about half. The model level reduces success rate but does not eliminate the attack surface, because the problem is in architecture.

Is this attack really used? No. Results of laboratory. The tests were carried out in sealed environments with fake boxes and fake users, not used against real people.

The value of assistants with memory comes from remembering the user. The same feature gives the attacker a permanent handle. Walking with sound cloning Artificial intelligence identity imitation scam When the user mimics himself, memory poisoning imitates that the user’s assistant knows him. The common point of two is that the attack is no longer to the system. The question of how much authorization to agents would be to return to the question of which authority will be withdrawn in the coming period.