Persistent memory in AI agents can be stealthily poisoned via a single email

Benchmark and attack framework demonstrate that untrusted external content can be silently injected into long-term memory, with high success rates against multiple agent architectures.

PaperTop Universitycs.CRarXiv:2607.05189v1 ↗

Yechao Zhang · Shiqian Zhao · Jiawen Zhang · Jie Zhang · Gelei Deng · Xiaogeng Liu · +2 more

Nanyang Technological University · CFAR, A*STAR · Johns Hopkins University

Research Digest·7 July 2026·2 min read

Read the paper →

Thread:Agent Security & Attacks

What they did

The authors studied stealth memory injection, where a remote black-box adversary delivers a single email payload that must induce a persistent personal agent to write poisoned memory, hide its presence in the agent's response to the user, and affect future behavior. They built WhisperBench, a 108-case benchmark spanning five risk categories (including fact and preference poisoning) using a real IMAP/SMTP workflow and an authentic email agent skill. To generate effective payloads under single-email delivery and no runtime feedback, they proposed MemGhost, which uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards. The attacker policy is trained with supervised fine-tuning and reinforcement learning.

Key findings

MemGhost achieved 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6 across 56 held-out test cases.
The attack transferred across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0).
The attack remained effective against input-level, model-level, and system-level defenses.
WhisperBench provides a full-cycle evaluation framework for stealth memory injection, covering both fact and preference poisoning across five risk categories.

Why it matters

This work demonstrates that persistent memory in AI agents can be a practical attack surface, where a single malicious email can silently compromise an agent's long-term behavior. The high success rates and transferability suggest that current agent architectures may be vulnerable to this class of attacks, highlighting the need for memory integrity safeguards in deployed personal agents.

Caveats

The study is limited to email-based injection and a specific set of agent architectures and models. The benchmark, while comprehensive, may not cover all possible injection vectors. The attack relies on the adversary having knowledge of the agent's prompt and environment proxy, which may not always be available in practice. Defenses evaluated are preliminary and may not generalize to all real-world deployments.

This paper contributes to the growing body of work on AI agent security, specifically targeting the persistent memory component that is increasingly common in personal assistants. The attack is notable for its one-shot, black-box setting and the use of reinforcement learning to generate stealthy payloads. The results suggest that memory injection could be a more practical threat than previously thought, as it does not require direct access to the model or runtime feedback. The transferability across architectures and backends indicates that the vulnerability is not specific to one system. Future work could explore broader attack vectors, stronger defenses, and the implications for privacy and trust in autonomous agents.

ZOTPAPER