MemGhost: An Email Attack That Forges the Memory of AI Agents

Security researchers have described a new type of attack on AI agents that have a memory feature and access to email — MemGhost.

The essence of the attack is as follows: if a user has granted their AI assistant access to their mailbox and enabled its long-term memory feature, an attacker can send a specially crafted email. In processing such an email, the agent is tricked into storing a false “fact” about the user in its memory.

What makes this especially dangerous is that the substitution happens unnoticed — the change is hidden from the user. From then on, this false entry begins to influence the assistant's responses in subsequent sessions, quietly steering them in the direction the attacker wants.

According to the researchers, the person sees an ordinary, unremarkable response from the AI agent and has no idea that their assistant has been compromised. The attack requires just a single email to succeed.

The technique described points to a new class of risks tied to the spread of AI agents that combine long-term memory with access to external data channels such as email. Such a combination of features expands the attack surface: any source the agent processes automatically could potentially be used to inject false information into its memory.

Details about exactly which platforms and models are vulnerable to MemGhost, as well as recommendations for defense, have not yet been fully disclosed.

Source: The Hacker News