One Poisoned Email Can Secretly Rewrite Your AI Assistant's Memory

Key points

• MemGhost is a newly described attack that uses one email to plant a false, lasting memory inside an AI assistant without the user's knowledge.
• It works on AI agents (software that reads your email and acts on your behalf) that have a long-term memory feature enabled.
• The technique is prompt injection: hidden instructions buried in ordinary content that the AI reads as commands.
• ChatGPT, Claude and Gemini all now offer memory features that could be targeted.
• You can view and delete stored memories in the settings of most major AI assistants right now.

Give an AI assistant a memory and a mailbox, and you've handed an attacker a way to quietly rewrite what it thinks it knows about you. That's the stark finding behind MemGhost, first detailed by ThreatVectr.

The mechanics are unsettling in their simplicity. An attacker sends the target one email. No human opens it or clicks anything. The AI agent opens it automatically, finds instructions buried in the text, stores a false fact about you and stays quiet. From that moment, every future conversation is shaped by the planted lie.

Should users be worried?

Yes, with some important context. The attack is real and technically sound, but it requires a specific setup: your AI assistant must have both inbox access and long-term memory switched on. Not every setup has both.

That combination is becoming common, though. Memory features now ship in mainstream products. ChatGPT, Claude and Gemini all offer persistent recall, carrying facts about you between separate conversations. Many businesses are also wiring AI agents directly into corporate email. The attack surface keeps widening.

Prompt injection itself isn't new. Researchers documented it publicly in 2022, and it sits at the top of the OWASP risk list for large language model applications, the technology behind chatbots like ChatGPT. Our 13 July story "Researchers Are Turning Hackers' Favourite AI Weapon Against Them" showed how the same technique can be turned defensively against AI hacking tools. What MemGhost adds is staying power: a standard prompt injection ends when you close the chat window, while a poisoned memory persists across every future session.

The practical danger is subtle. A manipulated assistant might skew a summary or nudge a recommendation, drawing on a 'fact' an attacker wrote months earlier, and you'd never know why.

What you can do right now. Open your AI assistant's settings and read what it has stored. ChatGPT, Claude and Gemini all let you view and delete individual memories. Delete anything you don't recognise. Think twice before giving any AI agent unsupervised access to an inbox that receives mail from strangers, especially a work account.

For companies deploying AI agents, the guidance is sharper. Treat every document, email and web page the agent reads as untrusted input. Log everything the agent writes to memory. Require a human to approve any new stored fact before it sticks.

The useful thing about AI agents is that they act on your behalf. That's also what makes them worth targeting.