GhostWriter Poisons AI Agent Memory With 98% Injection Rate

AI agents with long-term memory can retain user preferences, emails and workflows across sessions, allowing them to manage calendars, send messages and perform other tasks with less supervision. That capability also creates a persistent attack surface: untrusted emails or documents may be written into memory and later treated as authoritative context. GhostWriter exploits this gap by planting hidden instructions that can resurface during a legitimate request, potentially redirecting sensitive emails, leaking private information or corrupting decisions.

Researchers at New Mexico State University posted the GhostWriter study to arXiv on July 6, 2026, after testing five memory-agent architectures across four LLM families. Malicious payloads were written to memory in about 98% of trials and later activated in roughly 60%, showing that successful storage does not always translate into harmful action. The team also proposed Agentic Memory Sentry, or AM-Sentry, combining a memory-saving policy with a retrieval screen. Its strongest configuration cut end-to-end attack success below 12% for most models, while Llama averaged about 20%.