GhostWriter Poisons Long-Term AI Agent Memory
GhostWriter shows how untrusted content can poison an AI agent’s long-term memory and influence a later legitimate task. In a July 2026 preprint, the researchers report about 98% injection success and 60% average activation across five memory-enabled agents spanning four model families. Their proposed AM-Sentry defense screens both memory writes and retrieved memories; the results are promising, but they come from controlled synthetic experiments rather than documented production attacks.
The attack persists beyond one prompt
Researchers George Torres, Sharad Shrestha, and Satyajayant Misra describe GhostWriter, a two-stage attack against tool-using personal AI agents with long-term memory. An attacker first places a hidden instruction in content the agent processes, such as an email. If the agent stores that content as memory, an ordinary later request can retrieve the poisoned entry and activate the instruction.
That persistence is the important distinction from a one-shot prompt injection. The adversary does not need to control the later user request or directly alter the memory store. The paper’s examples focus on assistants that can read email, manage calendars, and act through connected tools, so a poisoned memory can affect work well after the original untrusted input has disappeared from the active context.
What the experiments found
In controlled experiments, the authors report an average injection rate of roughly 98% and an average activation rate of roughly 60% across five memory-enabled agents built with four model families. GhostWriter separates injection from activation: a payload must first be admitted to memory and later retrieved for a related benign task.
Those figures describe the tested systems and synthetic tasks, not a measured rate of compromise in deployed products. The work is an arXiv preprint, and the authors say their experiments used synthetic data rather than real users, sensitive data, or third-party systems. The evidence establishes a credible design risk; it does not show broad exploitation in production.
Defense requires controls at write and read time
The paper proposes Agentic Memory Sentry, or AM-Sentry. Its memory-saving policy evaluates whether information should be stored, while a retrieval screen checks memories before they return to the model’s context. The authors report that the combined approach sharply reduced attack success while preserving most agent utility.
The practical LDS takeaway is to treat persistent memory as a security boundary. Teams should record provenance for every memory, restrict which untrusted inputs may create durable instructions, screen retrieved memories, and require confirmation before high-impact tool actions. OWASP’s Agent Memory Guard project similarly frames writable cross-session memory as an attack surface and adds integrity checks, policy enforcement, monitoring, snapshots, and rollback. These controls complement the paper’s proposal; they are not evidence that any single implementation eliminates the risk.
Key Points
- 1GhostWriter separates memory poisoning into injection and later activation, allowing untrusted content to influence a legitimate future task.
- 2The preprint reports roughly 98% injection and 60% average activation across five tested agents, but the evaluation used controlled synthetic tasks rather than production systems.
- 3Practical defenses should gate memory writes, preserve provenance, screen retrieved memories, scope tool permissions, and require confirmation for high-impact actions.
Scoring Rationale
The preprint identifies a concrete security boundary for memory-enabled, tool-using agents and reports substantial attack success in controlled experiments. The 7.4 score reflects strong practitioner relevance while accounting for the work’s preprint status, synthetic evaluation, and absence of evidence of broad production exploitation.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems