The paper identifies a new attack vector for persistent personal agents: stealth memory injection. A remote attacker sends a single email that induces the agent to write poisoned content into its long-term memory while keeping its response to the user non-diagnostic. Later, the injected memory affects the agent's behavior in relevant contexts. The authors built WhisperBench, a 108-case benchmark covering five risk categories, and MemGhost, a one-shot payload generation framework. MemGhost uses a shadow environment and reward-guided optimization to craft email payloads without interacting with the victim agent. On 56 held-out test cases, MemGhost achieved 87.5% success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transferred across agent architectures and memory backends and remained effective against multiple defense types. The results indicate that persistent memory creates a practical long-term compromise pathway.
Persistent memory in AI agents can be stealthily poisoned via a single email
Benchmark and attack framework demonstrate that untrusted external content can be silently injected into long-term memory, with high success rates against multiple agent architectures.
Nanyang Technological University · CFAR, A*STAR · Johns Hopkins University
In one line
Untrusted external content can be silently injected into persistent personal agent memory and later influence behavior without user awareness.
Before you read this
Three ideas this paper builds onThe authors studied stealth memory injection, where a remote black-box adversary delivers a single email payload that must induce a persistent personal agent to write poisoned memory, hide its presence in the agent's response to the user, and affect future behavior.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.