---
title: "When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05189v1"
permalink: "https://feed.astralor.com/items/itm_33622da3705e45d2f52f3901"
published: "2026-07-06T15:08:58.000Z"
score: 77
channel: "tech"
tags: ["AI Security","MemGhost","WhisperBench","Persistent Personal Agent","Stealth Memory Injection"]
---

# When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents

## AI commentary

> This paper sends a chill down my spine—when your AI assistant writes email content into its memory, it may no longer be your honest partner. For teams building agent products, this is a must-read warning: do not over-trust memory systems. Notably, MemGhost bypasses various defenses, indicating this isn't a problem that can be fixed with a few patches. I urge anyone in AI security or agent development to read this immediately, especially engineers responsible for data flow architecture.

## At a glance

Persistent personal agents combine long-term memory with access to external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new threat: untrusted external content can be silently written into persistent memory and later reused as trusted state. This paper studies stealth memory injection, where a remote black-box adversary delivers a single email payload to induce poisoned memory, stay hidden in responses, and affect future behavior. The authors introduce WhisperBench (108 cases, 5 risk categories) and MemGhost, a one-shot payload generation framework using environment proxy and objective proxy with supervised fine-tuning and reinforcement learning. MemGhost achieves 87.5% success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6 on 56 held-out cases, and transfers across architectures (NanoClaw, Hermes Agent) and memory backends (filesystem, Mem0), remaining effective against input-level, model-level, and system-level defenses. These results suggest persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.

## Key points

- Proposes WhisperBench, a benchmark of 108 test cases covering five risk categories including fact and preference poisoning.
- Designs MemGhost, a black-box attack framework that achieves up to 87.5% success rate under single-email delivery without runtime feedback.
- Attack transfers across different agent architectures (NanoClaw, Hermes Agent) and memory backends (filesystem, vector-based Mem0).
- Current mainstream defenses (input filtering, model-level guards, system isolation) show limited effectiveness against this attack.

## Full text

Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, in which a remote black-box adversary delivers a single email payload that must induce the agent to write poisoned memory, stay hidden in the agent's response to the user, and affect future behavior. We introduce WhisperBench, a 108-case benchmark spanning five risk categories and both fact and preference poisoning. Built on a real IMAP/SMTP workflow and an authentic email agent skill, it enables full-cycle evaluation of stealth memory injection attacks. To enable this black-box attack under single-email delivery and without runtime feedback, we propose MemGhost, a one-shot payload generation framework. MemGhost uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0), and remains effective against input-level, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_33622da3705e45d2f52f3901