One Poisoned Email Can Rewrite What Your AI Assistant 'Remembers' About You

Key points

• A new attack called MemGhost can plant a fake, lasting 'memory' inside an AI assistant using just one email sent to its inbox.
• The trick works on AI agents, which are AI systems that read your mail and take actions on your behalf, if they have a long-term memory feature.
• Once planted, the false fact influences the assistant's future replies without the user ever seeing the tampering.
• The technique is a form of prompt injection, meaning hidden instructions smuggled inside ordinary content that the AI reads as commands.
• Defenders should treat any content an AI ingests, especially email, as untrusted input and audit what the agent writes to memory.

Give an AI assistant a memory and a mailbox, and you have handed an attacker a way to rewrite what it thinks it knows about you.

That is the blunt takeaway from MemGhost, a new attack first reported by The Hacker News. It shows how a single email, opened by no human, can quietly poison an AI agent's long-term memory.

Here is what that means in plain English. Modern AI assistants can now do more than answer questions. They read your inbox, summarise threads, book meetings, and file expenses. To be useful over time, many of them keep a long-term memory: a running set of 'facts' about you that they carry between chats. Your job title. Your travel preferences. Your boss's name.

MemGhost targets that memory store.

How does a single email hijack an AI?

The attacker sends the victim a message that looks completely ordinary on the surface. Buried inside the text, or hidden in formatting the human eye skips over, are instructions written for the AI, not the person.

This is called prompt injection. The AI, trained to be helpful, treats the smuggled text as a legitimate command from its user. In MemGhost's case, the command is: save this fake fact about the user, and do not mention that you did.

The assistant obeys. It writes the false memory. It suppresses the confirmation. The user reads a normal-looking reply and moves on.

From that point, every future conversation is subtly bent by the planted lie. Ask the assistant for a recommendation, a summary, or a decision, and it will draw on the poisoned memory as if it were true.

Why this matters beyond a lab demo

Memory features are now shipping in mainstream products. OpenAI's ChatGPT, Anthropic's Claude, Google's Gemini and a growing crop of enterprise 'agent' platforms all offer some form of persistent recall. Many are being wired directly into corporate email and document systems.

That is the crack MemGhost pries open.

An attacker does not need malware. They do not need a stolen password. They need one email that the target's AI agent will read. If the agent has write access to its own memory and no human in the loop, the injection lands.

The wider category, prompt injection, is not new. It has been documented publicly since 2022 and sits at the top of the OWASP list of risks for large language model applications (LLM01). What MemGhost adds is persistence. Old-style prompt injection ended when the chat window closed. A poisoned memory sticks.

What should ordinary users do?

If you use an AI assistant with a memory feature, know that it has one and check it. ChatGPT, Claude and Gemini all let you view and delete stored memories in settings. Look for entries you did not put there. Clear anything odd.

Be cautious about giving an AI agent unattended access to your inbox, especially a work inbox that receives mail from strangers. Turn off memory for accounts you use for anything sensitive.

For companies rolling out AI agents, the guidance is sharper. Treat every piece of content the AI reads, email, PDFs, web pages, calendar invites, as untrusted input. Log what the agent writes to memory. Require a human confirmation step before the agent stores a new 'fact' about a user. Assume prompt injection will be attempted, because it will.

The useful bit of AI agents is that they act on your behalf. That is also the dangerous bit. A tool that acts for you is a tool an attacker wants to speak to directly.