• 2 min read
GhostWriter attack plants false memories in AI agents
Researchers warn that GhostWriter can plant malicious memories in AI agents, with tests showing approximately 98% injection and 60% activation rates.
Image: TechXplore
Persistent memory makes AI agents more useful, allowing them to recall a user’s preferences and earlier requests. It also creates a new attack surface, researchers at New Mexico State University warn.
The team described GhostWriter, a cyberattack that secretly inserts unreliable or malicious information into an agent’s long-term memory. The poisoned content can later influence responses or trigger automated actions when a legitimate request retrieves it.
“Personal assistant agents sit at the convergence of these two domains and handle sensitive information while interacting with untrusted information sources, creating previously unaccounted security vulnerabilities.”
How the GhostWriter attack works
GhostWriter has two stages: injection, when an attacker sends a hidden payload to the target agent, and activation, when the poisoned memory is retrieved and acted upon. A false memory could instruct an email-management agent to summarize messages from a particular sender and secretly forward them to an attacker.
Recommended reading
Claude Chrome Extension Still Exposed to Synthetic Clicks
That could expose sensitive correspondence from banks, financial institutions or other official organizations. In tests, the attack achieved an injection rate of approximately 98% and an average activation rate of approximately 60% against state-of-the-art agents.
AM-Sentry mitigation techniques
The researchers proposed Agentic Memory Sentry (AM-Sentry), which combines two safeguards:
- A memory-saving policy to govern what information enters long-term memory.
- A memory-retrieval screen to assess stored information before it influences the agent.
“Our experiments show that AM-Sentry dramatically reduces GhostWriter’s success rate while preserving agent utility.”
The team’s paper, “When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents,” was published on arXiv in 2026. DOI: 10.48550/arxiv.2607.06595.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via TechXplore
