---
title: "利爪记忆而不言：持久性个人代理中的隐蔽内存注入攻击"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.05189v1"
permalink: "https://feed.astralor.com/items/itm_33622da3705e45d2f52f3901"
published: "2026-07-06T15:08:58.000Z"
score: 77
channel: "tech"
tags: ["AI安全","MemGhost","WhisperBench","持久性个人代理","隐蔽内存注入"]
---

# 利爪记忆而不言：持久性个人代理中的隐蔽内存注入攻击

## AI 点评

> 这篇文章让我后背一凉——当你的AI助手把邮件内容写进记忆，它可能不再是你诚实的伙伴。对构建Agent产品的团队来说，这几乎是必读的警告：不要过度信任记忆系统。值得关注的是，MemGhost成功绕过了多种防御，说明这不是修补一两个漏洞就能解决的问题。我建议所有从事AI安全或Agent开发的人立即研读，尤其是负责数据流架构的工程师。

## 速览

持久性个人代理结合长期内存与用户外部环境访问，实现个性化前台协助和主动后台执行。但这种整合也带来新威胁：不受信任的外部内容可被静默写入持久内存，随后作为可信状态重用。本文研究此类隐蔽内存注入攻击，其中远程黑盒攻击者通过单个邮件载荷诱导代理写入恶意内存、隐藏于用户响应、并影响未来行为。作者提出WhisperBench基准（108个案例，覆盖5种风险类别）和MemGhost攻击框架（基于环境代理和目标代理，利用监督微调和强化学习训练攻击策略）。在56个保留测试案例中，MemGhost在OpenClaw+GPT-5.4上达到87.5%成功率，在Claude Code SDK+Sonnet 4.6上为71.4%，并可迁移至其他架构和内存后端，对多种防御有效。结果表明持久内存可将普通外部处理变为长期代理妥协的实用途径。

## 关键点

- 提出WhisperBench基准，包含108个测试案例，覆盖事实注入和偏好注入等5种风险类别。
- 设计MemGhost攻击框架，无需运行时反馈即可在单邮件投递下实现黑盒攻击，成功率高达87.5%。
- 攻击可跨不同代理架构（NanoClaw、Hermes Agent）和内存后端（文件系统、向量数据库Mem0）迁移。
- 当前主流防御（输入过滤、模型防护、系统隔离）对该攻击效果有限。

## 全文

Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, in which a remote black-box adversary delivers a single email payload that must induce the agent to write poisoned memory, stay hidden in the agent's response to the user, and affect future behavior. We introduce WhisperBench, a 108-case benchmark spanning five risk categories and both fact and preference poisoning. Built on a real IMAP/SMTP workflow and an authentic email agent skill, it enables full-cycle evaluation of stealth memory injection attacks. To enable this black-box attack under single-email delivery and without runtime feedback, we propose MemGhost, a one-shot payload generation framework. MemGhost uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0), and remains effective against input-level, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_33622da3705e45d2f52f3901