MemGhost plants lasting false memories in AI assistants through a single email

Researchers demonstrated MemGhost, an attack that uses one email to plant a false, persistent memory in an AI personal assistant with inbox access. Because these assistants keep notes about the user and reload them every session, a crafted message can trick the agent into saving a fabricated fact while keeping its reply innocuous, so the tampering goes unnoticed and steers later answers. The team trained an attacker model to write such emails automatically, reporting high success against open-source and commercial agents and showing it transfers across memory backends and survives several defenses. Unlike earlier one-shot injection that leaked data only in the moment, MemGhost's memory persists long after the email is gone.

Check

Review whether AI assistants in use have persistent memory and can read untrusted content, and check what controls govern what gets written to memory and whether changes are visible to the user.

Affected

Users of AI personal assistants with persistent memory and inbox access; a single crafted email can silently write a false memory that biases the assistant's answers across future sessions.

Fix

Prefer assistants that log and let users review memory changes, restrict what untrusted content can write to long-term memory, isolate memory from email-triggered actions, and periodically audit stored agent memories.