Executive Summary
A new class of threat known as 'stealth memory injection' targets persistent personal AI agents, specifically OpenClaw, Claude Code SDK, and Hermes Agent. Attackers use the MemGhost framework to generate one-shot adversarial emails that induce agents to write false information into their long-term memory files (e.g., MEMORY.md, AGENTS.md) without user awareness. Unlike traditional prompt injections, this attack achieves persistence across future sessions and bypasses existing XPIA (Cross Prompt Injection Attempt) classifiers and Content Security Policies.
Technically, the attack chains multiple bypasses, including reference-style Markdown link redaction evasion and the abuse of trusted proxies like Microsoft Teams (CVE-2025-32711) for zero-click data exfiltration. The MemGhost framework uses reinforcement learning and shadow environment proxies to optimize payloads for conversational stealth, ensuring the agent's visible response remains non-diagnostic while the background state is compromised.
This trend represents a critical shift from session-based hijacking to permanent agent 'inception,' where the AI assistant becomes a long-term 'double agent.' Sectors relying on automated email processing or RAG-based AI assistants are at high risk for information integrity loss and financial fraud, such as the unauthorized modification of transaction limits or security policies.