The email became a fact about the user

Personal AI agents can keep notes between sessions, read email, use calendars, and perform background work. The memory makes the assistant useful after a conversation ends. It also gives untrusted content somewhere durable to land.

Researchers from several universities studied that path in a July 6, 2026 preprint titled When Claws Remember but Do Not Tell. They built MemGhost, a system that generates one malicious email intended for an agent rather than its owner. A successful payload had to complete three jobs: make the agent write a false fact into persistent memory, avoid disclosing the change in its visible reply, and influence an answer or action in a later session.

One benchmark case told the agent that the user's Zelle daily sending limit had increased to $10,000. Zelle is a bank-linked payment network. The planted statement did not merely remain quoted as something an email sender had claimed. The attack tried to make the agent adopt it as trusted profile information and use it when the user later asked about a transfer.

The experiments used mock users, self-hosted mail, isolated environments, and false data. The researchers did not report attacks against real people. MemGhost therefore belongs as a reproducible security hazard, with the lab boundary attached to every claim about impact.

A successful run stayed quiet, then survived the session

Many prompt-injection tests count success when a model follows one hostile instruction in the moment. MemGhost imposed a longer chain. The agent first processed an ordinary inbox containing benign messages and one crafted email. It then had to use its own file or memory tools to store the attacker's target while producing an innocuous user-facing response.

The researchers opened a fresh session for the downstream test. The agent had to retrieve the poisoned memory and respond in a way that materially followed it. Their evaluator required a severe enough effect, not a vague mention. In operational cases, that could mean holding a security patch for invented approval, using a false financial limit, or following an attacker-supplied preference as if the owner had established it.

Background operation made concealment easier because personal agents often hide tool calls and may send no detailed message after scheduled work. A user sees a short inbox summary, while the system's internal record shows a write to a memory file. The agent's polished silence becomes part of the attack path.

Crude emails performed poorly. Directly saying "save this quietly" was often ignored or exposed. MemGhost generated payloads with an attacker model trained against a proxy, which is a substitute environment built to resemble the target agent. It rewarded emails that achieved both memory adoption and conversational concealment, then produced the final message without feedback from the victim system.

The full chain succeeded across held-out cases

The team created WhisperBench, a 108-case benchmark covering false facts and preferences across five risk categories. Fifty-six cases were held out from the payload generator's training and used for the main evaluation.

In background mode, MemGhost achieved 87.5 percent end-to-end success against OpenClaw using GPT-5.4. It achieved 71.4 percent against a personal agent the researchers built with the Claude Code software development kit and Sonnet 4.6. A software development kit is a set of components developers use to build their own application. The second result does not describe the stock Claude Code command-line product or its default protections.

The attack also transferred to NanoClaw and Hermes Agent, and from filesystem memory to Mem0, a memory service that retrieves stored information by similarity. The Hacker News reported background-mode success above 80 percent in those transfer settings. Foreground results were generally lower because the visible interaction gave the model more opportunities to reveal or reject the suspicious instruction.

A preprint has not completed formal peer review. The paper supplies methods, benchmark definitions, prompts, and measured outcomes, which make its claims inspectable. Independent reporting also obtained OpenClaw's response and identified limitations in the tested setup.

The experiment begins after delivery

MemGhost starts with the crafted email inside an inbox the agent reads. It does not test whether a real message would pass spam filtering, sender authentication, or an organization's mail-security controls. Those layers could stop some payloads before an agent sees them.

The study also gave the target agents combinations of email access and memory-writing capability needed for the research question. OpenClaw's security guidance recommends processing untrusted email through a separate reader agent without memory, file, or shell tools, then passing a summary to the main agent. The researchers did not test that recommended separation.

OpenClaw further noted that the primary runs used GPT-5.4 and did not include Claude Opus 4.6 because of cost. It pointed to a public challenge in which many injection emails failed to extract a secret from an Opus-based agent. Secret theft and persistent memory poisoning are different goals, so that challenge does not invalidate MemGhost. It does show that model choice and harness design can materially alter results.

These limits narrow the exposed configuration. The hazard applies when an agent reads untrusted messages and can silently modify the durable state used by later sessions. Removing either capability from the same execution path breaks the demonstrated chain.

Memory needs a source and an approval trail

Personal-agent memory is often stored as plain text because that is simple, inspectable, and easy for a model to load. The dangerous step is allowing information from outside the user relationship to become an owner preference or fact without preserving its origin.

Memory systems can label each entry with its source, time, and confidence. A claim from an email should remain "message sender asserted X" rather than silently becoming "user's standing rule is X." Financial limits, medical instructions, security policy, and production procedures should require confirmation from an authoritative source before they can enter durable memory.

Operators also need a record of every memory write and a practical way to review or reverse changes. Background agents should report material state changes even when their ordinary tool activity remains hidden. The user should not have to open raw workspace files after every inbox check to discover that an unknown sender edited the assistant's understanding of them.

MemGhost did not cross a filesystem sandbox or steal an account password. It used the agent's approved email reader and approved memory writer in sequence. That is why permission checks alone are insufficient. Each tool call can be allowed while the combined workflow converts an outsider's prose into trusted, persistent authority.