AI agents can be tricked into remembering attacks

Researchers at New Mexico State University have identified persistent memory as a new attack surface for AI agents. Their GhostWriter method does not compromise the underlying model; instead, it plants false “memories” that can resurface days or weeks later and influence the agent’s decisions.

The attack uses an ordinary email, calendar invitation, or other external document as a container for hidden instructions. If an agent reads the content and stores it in memory, the malicious entry remains available. It may be triggered later when the user makes an otherwise routine request.

The researchers tested GhostWriter in scenarios involving agents that process email and calendars. On average, the attack injected malicious memories with an effectiveness of about 98% and later activated them in roughly 60% of subsequent queries.

Recommended reading

Ostium loses $23.75 million in price-feed attack

Unlike conventional prompt-injection attacks, which target the current conversation and must be detected immediately, GhostWriter corrupts information the agent has saved as useful context. That creates a serious risk for systems handling email, schedules, code, and corporate documents.

Protecting AI agent memory

The researchers proposed Agentic Memory Sentry, or AM-Sentry, to counter the threat. The system checks information before it is written to memory and separately reviews retrieved memories before passing them to the language model.

In its strictest configuration, AM-Sentry reduced GhostWriter’s effectiveness to less than 12% while making little impact on the agent’s useful functions.

The findings come as OpenAI, Google, Anthropic, and other developers promote agents that act on users' behalf and retain context between sessions. As persistent memory makes these systems more useful, failures in memory validation become increasingly costly.