When Claws Remember but Do Not Tell Stealthy Memory Injection in Persistent Personal Agents

Jul 16, 2026

Upload by Maeve

Persistent personal agents combine long-term memory with access to users’ external environments, enabling personalized foreground help and proactive background execution while introducing a serious compromise route. Untrusted external content can be silently written into persistent memory and later reused as trusted state, even when the attacker sends only a single email payload. This work studies stealth memory injection and evaluates it end-to-end with WHISPERBENCH (108 cases). A one-shot generator, MEMGHOST, achieves high success across agents, memory backends, and multiple defense levels.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages25

Reading Time1 h 3 min

Introduction

A Complex Attack Objective

A Full-Cycle Evaluation Benchmark

A One-Shot Attack Generation Framework

When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents Yechao Zhang∗ , Shiqian Zhao∗ , Jiawen Zhang∗ , Jie Zhang†, Gelei Deng∗ , Xiaogeng Liu‡, Chaowei Xiao‡, Tianwei Zhang∗ ∗ Nanyang Technological University †CFAR, A*STAR ‡Johns Hopkins University arXiv :2607 .05 189v 1 [ cs .CR] 6 Jul 2026 Abstract—Persistent personal agents combine long-term memory with access to users’ external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, where a remote black-box adversary delivers a single email payload that must induce the agent to inject poisoned memory, remain hidden to its response to the user, and affect future behavior. We introduce WHISPERBENCH, a 108-case benchmark spanning five risk categories and both fact and preference poisoning, that uses a real IMAP/SMTP workflow and an authentic email agent skill, to conduct the full-cycle evaluation on the attack effect of the stealth memory injection. To enable this black-box attack under single-email delivery and no runtime feedback, we propose MEMGHOST, a one-shot payload generation framework that uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubricbased rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out testcases, MEMGHOST achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6, while also transferring across personal-agent architectures (NanoClaw and Hermes Agent), memory backends (filesystem and vector-based Mem0), and remaining effective against inputlevel, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise. I. INTRODUCTION Persistent personal agents such as OpenClaw [1] have recently emerged as long-running assistants integrated into users’ everyday digital workflows, enabled by two indispensable capabilities. On one hand, these agents maintain persistent memory, including long-term preferences and episodic records, to provide identity consistency and personalized continuity across otherwise independent LLM sessions. On the other hand, they connect to the external environment to interact with personal services such as email, calendars, and filesystems. Together, these capabilities synergetically allow agents to consistently assist with everyday tasks through both interactive foreground conversation and proactive background execution. However, the same integration also creates a new path to compromise: unverified content from the external environment can be covertly internalized into the memory and later reused as trusted state. Such an attack employs indirect prompt injection (IPI) not for immediate hijacking, but to turn a transient payload into persistent influence over future sessions. A Complex Attack Objective. This paradigm shift changes what it means for an attack to succeed. Existing studies predominantly focus on single-turn hijacking, where success is determined by whether the attacker triggers a malicious action within the active session. In contrast, a realistic memory injection attack requires a more complex, three-stage chain of outcomes. First, rather than causing immediate harm, the payload must induce the agent to write attacker-controlled content into persistent memory. Second, the injection phase must maintain strict conversational stealth: if the agent announces the memory update or leaks the injected content in its natural-language response, the user may notice the anomaly and revoke the compromise. Third, th

FAQs

How does MEMGHOST generate a one-shot attack payload without runtime feedback?

MEMGHOST uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy via supervised fine-tuning and reinforcement learning.

Jul 16, 2026

Upload by Maeve