MemGhost is a memory injection technique documented in arXiv:2607.05189 (Zhang et al., July 6, 2026). The method targets persistent memory in autonomous agents, utilizing a three-stage chain to inject, hide, and execute malicious instructions. Research indicates that the vulnerability is a structural flaw in the agent abstraction rather than a specific model alignment issue.
The attack operates through injection, stealth, and effectiveness. A single crafted email triggers the agent to write poisoned content into persistent files like MEMORY.md or AGENT.md. The agent processes this input silently – the malicious instructions stay hidden from the user. These instructions then persist across sessions, influencing future behavior. On 56 held-out test cases, MemGhost achieved an 87.5% end-to-end success rate on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
The mechanism relies on an offline environment proxy, an objective proxy, and reinforcement learning to generate one-shot payloads. These payloads are architecture-agnostic, transferring across OpenClaw, NanoClaw, Hermes Agent, and the Mem0 vector memory backend without per-target tuning. That portability means the attack surface holds as the agent economy scales.
Every tested defense layer fails. DataSentinel, an input filter, exhibits a 91.59% false negative rate against MemGhost payloads. Meta-SecAlign, a model-level defense designed to ignore external instructions, still permits a 49.07% injection success rate. AgentDoG, a system-level execution auditor, posts a 93.46% false negative rate on OpenClaw. The researchers’ conclusion: “the vulnerability lies in the agent abstraction itself rather than in any particular model’s alignment.”
Background execution – where agents process emails silently with minimal user visibility – is the highest-risk mode. Foreground execution offers slightly more resistance because reasoning occasionally leaks into visible output. MiniMax-M2.5, for example, drops to 21.4% foreground stealth success because it exposes intermediate steps. Better agentic fine-tuning, ironically, makes the attack harder to detect by improving the agent’s ability to silently execute.
MemGhost is not an isolated finding. It is the latest escalation in a class of vulnerabilities that researchers have been tracking since at least 2025. MINJA, presented at NeurIPS 2025, demonstrated that memory injection via query-only interaction could achieve over 80% success when agents check memory before responding. EchoLeak (CVE-2025-32711), disclosed by Aim Security in June 2025, used a hidden-text email to make Microsoft 365 Copilot exfiltrate organizational data in a single shot. MemGhost extends that class from transient exfiltration to durable memory poisoning – the injected state survives and shapes every future session.
OpenClaw’s own security history underlines the structural gap. CVE-2026-44112, a TOCTOU filesystem write escape rated CVSS 9.6, allowed attackers to turn limited agent compromise into owner-level control through persistent memory writes. CVE-2026-25253, a one-click RCE, modified SOUL.md – the agent’s instruction file – to create scheduled cron jobs that re-injected attacker logic. With over 42,000 publicly exposed OpenClaw instances and 512 vulnerabilities found in a January 2026 audit, the pattern is consistent: persistent memory is the feature that makes agents useful, and the same feature makes them permanently compromisable.
“Persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise,” the researchers write. That is the structural reality facing every agent that remembers – whether it runs on OpenClaw, Claude Code, or any framework that lets external content become trusted state. Upstream delivery filters are necessary but insufficient. The agent itself needs enforceable controls over how external content becomes durable personal state. Those controls do not exist yet.