Researchers have demonstrated an attack they call MemGhost that uses a single email to plant a persistent false memory in an AI assistant, as reported by The Hacker News. Give an assistant a memory feature and access to an inbox, and an attacker gains a way to quietly rewrite what it believes about the user.

What makes this worse than ordinary prompt injection is that it lasts. A normal injection influences one response and is gone. MemGhost gets the agent to write a false fact into its long-term memory, conceal that it did so, and then draw on that fabricated memory in future conversations, long after the email that planted it is forgotten.

The consequences follow from what the memory shapes. An assistant that has been told a wrong fact about a person, a policy, or an account can make decisions, send messages, or take actions based on it, and the user has no obvious reason to distrust an answer that comes from the tool's own memory. The manipulation hides inside the thing that is supposed to make the assistant more helpful.

The defenses point at how memory is designed rather than at any single bug. Treat anything an agent reads, including email, as untrusted, require confirmation before the agent writes durable facts about a user, make memory changes visible and reviewable, and scope what a stored memory is allowed to influence. Persistent memory is powerful precisely because it carries forward, which is also why an attacker wants to write to it.

Sources: The Hacker News.