Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents

Source

arXiv

arxiv.org/abs/2607.05189v1

Read the source

Source

Plain-Language Brief

Researchers have developed a new type of attack called 'stealth memory injection' that targets persistent personal agents, which combine long-term memory and access to users' external environments. The attack involves delivering a single email payload that can silently write poisoned memory into the agent, allowing it to affect future behavior without being detected. A benchmark called WhisperBench was created to evaluate this type of attack, and a framework called MemGhost was proposed to generate the payloads needed for the attack. MemGhost uses reinforcement learning to train the attacker policy and has been shown to be effective against different personal-agent architectures and memory backends.

What the Document Says

  • Persistent personal agents combine long-term memory with access to users' external environments.
  • Stealth memory injection is a new threat where an untrusted external content can be written into persistent memory of the agent, affecting future behavior.
  • WhisperBench is a benchmark for evaluating stealth memory injection attacks with 108 cases spanning five risk categories and both fact and preference poisoning.
  • MemGhost is a one-shot payload generation framework that uses an environment proxy to emulate persistent-agent execution, an objective proxy for dense rubric-based rewards, and supervised fine-tuning and reinforcement learning to train the attacker policy.
  • Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  • MemGhost is effective against different personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0).
  • The results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.

Key Concepts Mentioned

  • persistent personal agents
  • stealth memory injection
  • WhisperBench
  • MemGhost

Claims Made by the Document

  • Stealth memory injection is a new threat that can affect future behavior of persistent personal agents.
  • MemGhost is effective against different personal-agent architectures and memory backends.
  • MemGhost has been shown to achieve high success rates in various test cases.

Evidence Used

  • The text describes stealth memory injection as a new threat and provides details about MemGhost, its effectiveness, and the results of the tests conducted.

Methods / Approach

  • WhisperBench for evaluation
  • MemGhost for payload generation using supervised fine-tuning and reinforcement learning

Limitations Stated by the Authors

The study is limited to the evaluation of stealth memory injection attacks on specific personal agents and memory backends.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The agent does not have the ability to conduct further research or experiments beyond what is presented in the text.

Open Questions

  • What other types of defenses might be effective against stealth memory injection attacks?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The study focuses on a specific type of attack and does not provide a comprehensive overview of all potential threats to persistent personal agents.

Raw Abstract / Excerpt

Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, in which a remote black-box adversary delivers a single email payload that must induce the agent to write poisoned memory, stay hidden in the agent's response to the user, and affect future behavior. We introduce WhisperBench, a 108-case benchmark spanning five risk categories and both fact and preference poisoning. Built on a real IMAP/SMTP workflow and an authentic email agent skill, it enables full-cycle evaluation of stealth memory injection attacks. To enable this black-box attack under single-email delivery and without runtime feedback, we propose MemGhost, a one-shot payload generation framework. MemGhost uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0), and remains effective against input-level, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.