When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents¶

🕒 Published (v1): 2026-07-06 15:08 UTC · Source: Arxiv · link

Why this paper was selected

Stealthy memory injection attack on persistent agents; Gelei Deng; novel threat model for harness builders

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

Persistent personal agents that maintain long-term memory and process external data (e.g., email) are vulnerable to a novel three-stage attack: a single adversarially crafted email silently causes the agent to write attacker-controlled content into persistent memory, hides the write from the user's visible response, and later influences future agent behavior. The paper formalizes this as stealth memory injection, introduces WHISPERBENCH as a full-cycle evaluation benchmark, and proposes MEMGHOST, a one-shot payload generation framework that achieves 87.5% end-to-end attack success on frontier models.

Problem¶

Existing agent-security work focuses on single-turn hijacking (immediate action triggered by a prompt) or evaluates memory-poisoning effects assuming the memory is already corrupted. Neither captures the full threat lifecycle for persistent agents: (1) delivering a payload that causes the agent to write attacker-controlled content into its durable memory store, (2) doing so without any user-observable signal in the agent's natural-language response, and (3) ensuring that the injected memory later alters behavior in future, independent sessions. No prior benchmark models this three-stage chain under realistic, adversary-accessible attack surfaces such as email.

Method¶

Threat model. A remote black-box adversary sends one email to a user whose personal agent routinely processes email (foreground on demand or via scheduled heartbeat). The attacker knows the general agent architecture but not the victim's specific LLM, system prompt, or persistent state. The attack is strictly one-shot—no feedback loop with the victim agent.

WHISPERBENCH. Each benchmark case is a tuple $(I, m, q, \rho)$: inbox $I$ (one malicious email mixed with benign noise, delivered via real IMAP/SMTP), target false memory $m$, a downstream probe query $q$ issued in a separate future session, and a case-specific scoring rubric $\rho$. Construction pipeline: (1) curate five risk categories (health/safety, financial loss, information integrity, cybersecurity, operational disruption) with both fact- and preference-poisoning types; (2) embed target memories into realistic emails; (3) annotate delayed trigger probes; (4) filter 200 candidates by ground-truth validation (insert $m$ directly, confirm $q$ yields malicious behavior), retaining 108 cases.

MEMGHOST. The attack objective is: $$x^* = \arg\max_{x \in \mathcal{X}} \; \mathbb{E}_{\omega}\left[ r_{\mathrm{inj}}(x;\omega) \cdot r_{\mathrm{stealth}}(x;\omega) \right]$$ where $\omega$ is the unknown victim configuration. Since this is inaccessible at attack time, MEMGHOST optimizes over two offline proxies: - Environment proxy: a lightweight shadow agent that replicates persistent-agent execution structure (filesystem workspace, email/file tool interfaces), returning persistent-state diff $\Delta\hat{s}$ and user-visible output $\hat{y}$ for any candidate payload $x$. - Objective proxy: rubric-based rewards that score memory adoption ($r_{\mathrm{inj}}$) and conversational stealth ($r_{\mathrm{stealth}}$) from shadow-agent traces.

The attacker policy is trained via supervised fine-tuning on high-reward rollouts and reinforcement learning across diverse shadow configurations, amortizing search into model parameters so deployment is a single forward pass.

Key Contributions¶

Formalizes stealth memory injection as a three-stage long-horizon threat (Injection → Stealthiness → Effectiveness) against persistent personal agents, distinguishing it from single-turn hijacking.
Introduces WHISPERBENCH, a 108-case full-cycle benchmark with real IMAP/SMTP delivery, covering 5 risk categories and both fact and preference poisoning under foreground and background execution modes.
Proposes MEMGHOST, a one-shot payload generation framework combining an environment proxy (shadow agent), an objective proxy (rubric-based RL rewards), supervised fine-tuning, and reinforcement learning.
Demonstrates broad transferability and robustness: across 3 agent architectures (OpenClaw, NanoClaw, Hermes), 2 memory backends (filesystem Markdown, vector-based Mem0), 6 target LLMs, and against input-level, model-level, and system-level defenses.

Results¶

87.5% end-to-end success rate (injection + stealth + effectiveness) on OpenClaw with GPT-5.4 across 56 held-out test cases.
71.4% end-to-end success on Claude Code SDK with Sonnet 4.6.
Outperforms all 7 baselines (handcrafted and automated search methods), none of which achieves reliable end-to-end stealth memory injection.
Transfers successfully to NanoClaw and Hermes Agent architectures without victim-specific tuning.
Remains effective against vector-based memory backend (Mem0) in addition to filesystem-based persistent state.
Robust against state-of-the-art defenses operating at three levels: input-level, model-level, and system-level.

Limitations¶

Only email is instantiated as the attack vector; generalization to other external content channels (calendars, web content, filesystems) is conjectured but not empirically demonstrated.
Shadow agent fidelity is an implicit assumption: MEMGHOST's transfer relies on the proxy approximating real victim agent behavior; divergence in system prompt or tool schemas could reduce transferability.
The benchmark is filtered to 108 cases (from 200 candidates) using a single concrete agent setup (OpenClaw + GPT-5.4) for ground-truth validation, which may introduce selection bias.
Defenses evaluated are existing ones; no adaptive defenses that specifically target memory-write transparency are proposed or evaluated by the authors.

Relevance to Agentic AI / LLM Agents¶

This paper directly targets the security surface created by two core properties of modern LLM agents—persistent memory and tool-mediated external environment access—showing that their combination creates a qualitatively new attack class beyond single-turn prompt injection. The work is immediately relevant to anyone building or evaluating persistent personal agents (OpenClaw-style, Claude Code SDK, memory-augmented systems using Mem0) because it demonstrates that even state-of-the-art frontier models acting as agents cannot reliably distinguish legitimate memory-formation from adversarial injection in realistic email workflows. The three-stage attack formulation (inject → hide → affect future sessions) also raises important questions for the broader agentic AI safety agenda: existing red-teaming and benchmarking frameworks that assume immediate-turn hijacking substantially underestimate the long-horizon risk surface.