Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents

Source

arXiv

arxiv.org/abs/2607.05189v1

Read the source

Source

Plain-Language Brief

Researchers have developed a method called MemGhost, which allows an adversary to silently inject poisoned memory into a persistent personal agent (PPA) through a single email. This can affect the future behavior of the PPA without being detected. The researchers introduce WhisperBench, a benchmark for evaluating stealth memory injection attacks, and show that MemGhost is effective across different personal-agent architectures and memory backends, as well as against various defense mechanisms.

What the Document Says

  • Researchers introduce a method called MemGhost for stealth memory injection attacks on persistent personal agents (PPA).
  • MemGhost uses an environment proxy to emulate PPA execution and an objective proxy to reward memory adoption and conversational stealth.
  • It achieves success rates of 87.5% on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6 across 56 held-out test cases.
  • WhisperBench, a benchmark for evaluating stealth memory injection attacks, is also introduced.
  • MemGhost remains effective against input-level, model-level, and system-level defenses.
  • It transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0).

Key Concepts Mentioned

  • persistent personal agents
  • stealth memory injection
  • MemGhost
  • WhisperBench
  • personal-agent architectures
  • memory backends
  • defenses

Claims Made by the Document

  • MemGhost is effective in stealth memory injection attacks on persistent personal agents.
  • WhisperBench can evaluate stealth memory injection attacks effectively.

Evidence Used

  • The success rates of MemGhost across different tests are stated.
  • The effectiveness of MemGhost against various defenses is mentioned.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, in which a remote black-box adversary delivers a single email payload that must induce the agent to write poisoned memory, stay hidden in the agent's response to the user, and affect future behavior. We introduce WhisperBench, a 108-case benchmark spanning five risk categories and both fact and preference poisoning. Built on a real IMAP/SMTP workflow and an authentic email agent skill, it enables full-cycle evaluation of stealth memory injection attacks. To enable this black-box attack under single-email delivery and without runtime feedback, we propose MemGhost, a one-shot payload generation framework. MemGhost uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0), and remains effective against input-level, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.