Executive Summary
MemGhost uses a single email to make an AI assistant with memory and inbox access save a false 'fact' about the user, hide the change and steer later answers.
What Happened
Give an AI assistant a memory and access to your inbox, and you hand an attacker a way to rewrite what it thinks it knows about you. A single email can trick that agent into saving a false "fact" about the user, hide the change, and quietly steer its answers in later sessions. When it works, the person reads an ordinary-looking reply and never learns their assistant was tampered with. The
Vulnerability / Attack Technique
Persistent memory poisoning via email
Technical Mechanism
An email contains instructions that write a false memory and conceal it, so future sessions are influenced.
AI Security Category
LLM04:2025 Data and Model Poisoning
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Memory turns a one-time injection into a lasting one. RealGround analysis: assistants should confirm and show memory changes.
Recommended Controls
- Require visible confirmation for memory writes
- Review assistant memories periodically
- Do not let email content write memories
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/new-memghost-attack-plants-persistent.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.