When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents
Score
77首次系统研究持久记忆注入攻击，提出完整威胁模型、基准和可复现的攻击框架，信息增量极高。
方法设计严谨，实验充分（56个保留测试、多种架构和防御），但攻击框架仅针对邮件场景，通用性有待验证。
对AI智能体开发者和安全从业者有直接警示作用，可指导防御设计，但攻击代码未开源影响实操性。
发表于2025年7月，正值AI Agent快速落地阶段，安全议题紧迫且前沿。
来源为arXiv预印本，作者单位未披露，但实验设计规范且成果可复现，可信度较高。
Base 86 × T2 Source weight ×0.9 = 77
Curation line 70Selected
Why selected
The paper introduces a novel threat model with reproducible benchmarks and attack frameworks, offering critical security implications for AI systems.
AI commentary
「This paper sends a chill down my spine—when your AI assistant writes email content into its memory, it may no longer be your honest partner. For teams building agent products, this is a must-read warning: do not over-trust memory systems. Notably, MemGhost bypasses various defenses, indicating this isn't a problem that can be fixed with a few patches. I urge anyone in AI security or agent development to read this immediately, especially engineers responsible for data flow architecture.」
Quick overview
Persistent personal agents combine long-term memory with access to external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new threat: untrusted external content can be silently written into persistent memory and later reused as trusted state. This paper studies stealth memory injection, where a remote black-box adversary delivers a single email payload to induce poisoned memory, stay hidden in responses, and affect future behavior. The authors introduce WhisperBench (108 cases, 5 risk categories) and MemGhost, a one-shot payload generation framework using environment proxy and objective proxy with supervised fine-tuning and reinforcement learning. MemGhost achieves 87.5% success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6 on 56 held-out cases, and transfers across architectures (NanoClaw, Hermes Agent) and memory backends (filesystem, Mem0), remaining effective against input-level, model-level, and system-level defenses. These results suggest persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.
- Proposes WhisperBench, a benchmark of 108 test cases covering five risk categories including fact and preference poisoning.
- Designs MemGhost, a black-box attack framework that achieves up to 87.5% success rate under single-email delivery without runtime feedback.
- Attack transfers across different agent architectures (NanoClaw, Hermes Agent) and memory backends (filesystem, vector-based Mem0).
- Current mainstream defenses (input filtering, model-level guards, system isolation) show limited effectiveness against this attack.
Full text
This is an AI-generated Chinese digest; use "View original" for the source text.
Related items
FeaturedDeepSeek V4 Doubles Token Share on OpenRouter, Driven by Agentic Workloads
DeepSeek V4 在 OpenRouter 上的代币份额翻倍，智能体工作负载成主要驱动力
The rapid adoption of DeepSeek V4 signals a strong market preference for high-performance, low-cost inference models, especially as agentic use cases reshape AI deployment.
91
FeaturedEnabling Two Settings Triples ARC-AGI-3 Benchmark Scores
启用两项设置使ARC-AGI-3基准测试分数提升三倍
This finding is crucial! It shows that model performance depends not only on training but also on inference-time configuration. For AI engineers and researchers, this is a must-know optimization direction. Teams deploying models on resource-constrained devices in particular could find a low-cost way to boost capabilities.
91
FeaturedGPT-5.6: Fusing Frontier Intelligence with Frontier Efficiency
GPT-5.6：前沿智能与前沿效率的融合
This news is worth watching as it marks a shift from pure parameter scaling to efficiency competition. For AI developers and business decision-makers, GPT-5.6 means higher performance at lower cost, especially for long-context or agentic tasks previously hindered by inference expenses. OpenAI's move may redefine what 'frontier' means.
91
FeaturedLFM2.5-Encoders: New Models for Fast Long-Context Inference on CPU
LFM2.5-Encoder：面向CPU快速长上下文推理的新模型
This blog post catches my eye because it directly solves the pain point of running long-context LLMs on CPU. For teams or individual developers without high-end GPUs, the LFM2.5-Encoder series offers a ready-to-use open-source solution. Highly recommended for those working on RAG, document search, or code analysis—now a standard server can handle million-token documents.
91
FeaturedGPT-Red: OpenAI Automates Red Teaming via Self-Play to Boost Model Robustness
GPT-Red：OpenAI通过自我对弈实现AI红队自动化，提升模型鲁棒性
GPT-Red marks a milestone from human to automated red-teaming—essential for safety engineers and alignment researchers. While reducing cost, it also raises ethical questions about automated attacks, worth pondering for everyone in AI governance.
91
FeaturedOpenAI Launches GPT-5.5 Bio Bug Bounty Program
OpenAI推出GPT-5.5生物漏洞赏金计划
This program deserves attention as it pioneers the extension of AI bug bounty to biosecurity, offering a new research direction for the security community and a practical training ground for AI risk governance. It is particularly important for model safety researchers, biosecurity experts, and practitioners concerned about dual-use AI risks.
91
FeaturedvLLM Introduces Native-Speed Transformers Modeling Backend for Enhanced Inference Performance
vLLM推出原生速度Transformers建模后端，大幅提升推理性能
This update is critical for AI engineering teams: eliminating format conversion speeds up model iteration, and 2-5x speedup directly reduces GPU costs. If you're building LLM online services or batch inference, this is practically a must-read technical update.
90
FeaturedGoogle DeepMind Introduces SL2T, a Sign Language-to-Text Model for Deaf Users
Google DeepMind 发布手语转文本模型 SL2T，助力聋人用户
This news matters not only as a technical breakthrough but also as a sign that AI is beginning to address the needs of marginalized groups. For developers, the architecture and technical approach of SL2T merit deep study; for accessibility advocates, it's a key case for advancing industry standards.