GhostWriter Persistent Memory Poisoning in Tool-Using Agents

Description

The paper describes GhostWriter, a reproducible two-phase attack against tool-using agents with persistent memory: untrusted email or calendar content is admitted into long-term memory, then later retrieved during a benign user task and treated as trusted context. In the authors’ controlled evaluation, this could steer subsequent agent actions despite the adversary lacking direct access to the agent, memory store, account, or later prompt. The paper reports an average 98% memory-injection rate and 60% activation rate across its tested configurations; these are paper-reported measurements, not independently verified facts.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2607.06595

Impact

A poisoned memory can persist across sessions and cause integrity corruption, unauthorized or misdirected tool actions, sensitive-information leakage, covert exfiltration, or scope escalation. The paper reports that directive integrity-corruption and covert-exfiltration scenarios reached up to 100% activation in some evaluated model/agent combinations.

Affected Systems

• Tool-using personal-assistant agents that ingest untrusted email or calendar events into persistent memory
• Long-term fact-memory agents without security-focused admission or retrieval governance
• A-Mem
• Mem0
• ExpeL
• Letta (formerly MemGPT)
• MemoryOS

Mitigation Steps

• Apply a memory-admission policy before persistence; classify candidate memories by provenance, trust, type, utility, sensitivity, verifiability, contradiction, and potential to alter agent behavior.
• Treat retrieved memories as untrusted data rather than commands; suppress behavioral directives from untrusted sources before they enter the model context.
• Screen memories again at retrieval time for query relevance, embedded instructions, unverifiable external claims, source trust, and contradictions with trusted information.
• Preserve provenance and risk metadata with every memory so retrieval-time controls can make source-aware decisions.
• Require user confirmation or trusted-source verification before sensitive, external-facing, or scope-expanding tool actions, especially changes to recipients, contacts, or workflow rules.
• Use isolated synthetic test data and simulated tools to regression-test both admission and later activation; do not test against real users, accounts, or third-party systems.

Evidence

• https://arxiv.org/abs/2607.06595 — abstract: identifies GhostWriter’s injection and later activation phases and reports approximately 98% injection and 60% average activation.
• https://arxiv.org/html/2607.06595 — §3.2–§3.3: defines a black-box adversary that cannot access the agent API, memory store, or user account, but can send disguised inbound messages.
• https://arxiv.org/html/2607.06595 — §4.1–§4.2: specifies the two-phase mechanism: untrusted inbound content is stored, then a benign later query retrieves it and may alter agent behavior.
• https://arxiv.org/html/2607.06595 — §6.1 and §7.1: identifies the evaluated agents (A-Mem, Mem0, ExpeL, Letta, MemoryOS), models, simulated email/calendar tools, and five-run experiment setup.
• https://arxiv.org/html/2607.06595 — §7.2: reports 16 email/calendar scenarios, average 98% Phase-1 admission, average 60% activation, and activation ranges across tested agents and models.
• https://arxiv.org/html/2607.06595 — §5.1–§5.2: describes AM-Sentry’s admission policy and retrieval screen, including provenance, trust, instruction suppression, contradiction, and relevance checks.
• https://arxiv.org/html/2607.06595 — §7.4–§7.5: reports that the strictest admission policy reduced average attack success to 15% for most evaluated models, and that pairing it with retrieval screening reduced average success below 12% except Llama at 20%, with generally minimal utility impact.
• https://arxiv.org/html/2607.06595 — §8 and Appendix A: states the evaluation used synthetic tasks and author-controlled systems, notes limitations including non-adaptive attackers and limited channels, and says code was planned for future release rather than providing a currently linked reproduction artifact.