• 2 min read
AI agents can now be tricked by fake memories
Researchers found a new attack on AI agents that plants false memories with 98% success and can trigger them later in 60% of follow-up tasks.
Image: ITzine
Researchers at New Mexico State University say persistent memory in AI agents has become a new attack surface. Their method, called GhostWriter, does not break the model itself. Instead, it feeds the agent false “memories” that can resurface days or weeks later and shape its decisions.
The attack is relatively simple. A normal email, calendar invite, or other external document acts as a container for hidden instructions. If an agent reads that data on its own and stores it, the malicious entry remains in memory. Later, when a user asks it to handle something routine, the trap can fire in a completely different context.
The authors tested the attack in scenarios where an AI agent processes email and calendar data. On average, GhostWriter was able to implant malicious memory with about 98% effectiveness, and later activate it in roughly 60% of cases during follow-up requests.
Recommended reading
Spy malware hides in Microsoft 365 calendars
That makes it different from classic prompt injection attacks, which usually target the current conversation and must be caught while the malicious command is still visible in the exchange. Here, the goal is not to force a wrong answer immediately, but to corrupt what the model stores as useful context. That is especially problematic for agents handling mail, schedules, code, and corporate documents.
In response, the researchers proposed Agentic Memory Sentry, or AM-Sentry. The system checks data before it is written to memory, and separately reviews retrieved memories before they are passed back to the language model. In its strictest configuration, AM-Sentry cut GhostWriter’s success rate to less than 12% while barely reducing the agent’s useful functionality.
The issue is already moving beyond the lab. OpenAI, Google, Anthropic, and other developers are pushing agent workflows where assistants act on a user’s behalf and retain context across sessions. As that memory becomes more useful, failures in screening it become much more costly.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via ITzine
