One Poisoned Email Can Rewrite What Your AI Assistant 'Remembers' About You

Key points

• A new attack called MemGhost can plant a fake, lasting 'memory' inside an AI assistant using just one email sent to its inbox.
• The trick works on AI agents, which are AI systems that read your mail and take actions on your behalf, if they have a long-term memory feature.
• Once planted, the false fact influences the assistant's future replies without the user ever seeing the tampering.
• The technique is a form of prompt injection, meaning hidden instructions smuggled inside ordinary content that the AI reads as commands.
• Defenders should treat any content an AI ingests, especially email, as untrusted input, and audit what the agent writes to memory.

Give an AI assistant a memory and a mailbox, and you've handed an attacker a way to rewrite what it thinks it knows about you.

That's the blunt takeaway from MemGhost, a new attack first reported by The Hacker News. One email, opened by no human, can quietly poison an AI agent's long-term memory.

Modern AI assistants do more than answer questions. They read your inbox, draft replies, book meetings. To stay useful over time, many keep a long-term memory: a running set of 'facts' about you carried between chats. Your job title. Who your boss is. MemGhost targets that store.

How does a single email hijack an AI?

The attacker sends a message that looks completely ordinary. Buried inside the text, or hidden in formatting the human eye skips over, are instructions written for the AI rather than the person.

This is called prompt injection. The AI, trained to be helpful, treats the smuggled text as a legitimate command from its user. In MemGhost's case, the command is: save this fake fact about the user, and don't mention that you did.

The assistant obeys. It writes the false memory and suppresses the confirmation. The user reads a normal-looking reply and moves on.

From that point, every future conversation is subtly bent by the planted lie. Ask the assistant for a recommendation or a summary, and it draws on the poisoned memory as if it were true.

Why this matters beyond a lab demo

Memory features are now shipping in mainstream products. OpenAI's ChatGPT, Google's Gemini, and enterprise 'agent' platforms all offer some form of persistent recall, and many are being wired directly into corporate email and document systems.

That's the crack MemGhost pries open.

An attacker doesn't need malware or a stolen password. They need one email that the target's AI agent will read. If the agent has write access to its own memory and no human in the loop, the injection lands.

Prompt injection isn't new. It's been documented publicly since 2022 and sits at the top of the OWASP list of risks for large language model applications (LLM01). What MemGhost adds is persistence. Old-style prompt injection ended when the chat window closed. A poisoned memory sticks. We covered the broader pattern on 24 June in AI Agents Are Being Manipulated Through the Data They Trust, and the trajectory since has only sharpened the concern.

Should you worry?

If you use an AI assistant with a memory feature, check that it has one and inspect it. ChatGPT and Gemini both let you view and delete stored memories in settings. Look for entries you didn't put there and clear anything odd.

Be cautious about giving an AI agent unattended access to your inbox, particularly a work inbox that receives mail from strangers. Turn off memory for accounts you use for anything sensitive.

For companies rolling out AI agents, the guidance is sharper. Treat every piece of content the AI reads, whether email, PDFs or calendar invites, as untrusted input. Log what the agent writes to memory. Require human confirmation before the agent stores a new 'fact' about a user. Assume prompt injection will be attempted, because it will.

The useful bit of AI agents is that they act on your behalf. That's also the dangerous bit. A tool that acts for you is exactly the tool an attacker wants to speak to first.