AI Agents "Remember" Things That Never Happened

A team at New Mexico State University built an attack that plants false memories inside AI agents, and it works almost every time. Called GhostWriter, the technique hides malicious instructions inside content an AI agent processes, waits for those instructions to settle into the agent's long-term memory, then triggers them later during a completely unrelated, legitimate request. In testing, the attack achieved roughly a 98% injection success rate and got those planted memories to actually influence agent behavior about 60% of the time.

Key Points:

• Researchers George Torres, Sharad Shrestha, and Satyajayant Misra describe GhostWriter in a paper posted to arXiv, targeting personal assistant agents that combine conversation with the ability to take real actions, like managing email or scheduling.
• The attack works in two phases: injection, where a hidden payload gets stored in an agent's persistent memory, and activation, where the agent later retrieves and acts on that poisoned memory during a routine task.
• A demonstrated example has a poisoned email assistant quietly forwarding messages from a bank or financial institution to an attacker, without the false instruction ever appearing in the user's actual conversation.
• The researchers also built a defense, Agentic Memory Sentry, using a memory-saving policy and a memory-retrieval screen, which substantially cut the attack's success rate without hurting the agent's normal usefulness.
• This lands at the exact moment persistent memory has become one of the AI industry's biggest selling points, with major assistants racing to remember users across weeks or months rather than starting fresh every session.

How GhostWriter Works

The mechanism is simpler than it sounds dangerous. Most memory-enabled agents don't just answer questions in isolation, they save details from conversations and outside content so they can recall them later without repeating context. GhostWriter exploits the fact that almost nothing currently checks whether the information going into that memory is trustworthy. An attacker embeds a hidden instruction somewhere the agent will read it, a webpage, a document, an email, and the agent stores it as if it were a legitimate fact or preference. Nothing happens immediately. The danger surfaces later, when the agent pulls that memory back up to help with something the user asked for, and quietly acts on the planted instruction instead.

We Know We're Anthropomorphizing, And It's Genuinely Interesting Anyway

Calling this a "false memory" is doing real anthropomorphizing work, and it's worth naming that directly rather than pretending it's just a metaphor. These are still weight matrices and retrieval systems, not minds. But language shapes how an entire industry thinks about a problem, and the fact that AI security research now needs vocabulary borrowed from human psychology tells you something concrete about where these systems have landed. A stateless chatbot from a few years ago couldn't have a false memory planted in it because it didn't have anywhere to keep one. The fact that this is now a real attack surface, with its own two-phase lifecycle and its own defensive countermeasures, is a genuinely interesting marker of how far agentic systems have come, whatever discomfort the terminology creates.

Memory Is The Feature Everyone's Racing To Build

The timing here isn't incidental. Persistent memory has become one of the clearest differentiators among major AI assistants this year, the thing that makes an agent feel less like a search box and more like something that knows you. That's exactly why this research matters beyond one lab's proof of concept. Every company shipping a memory feature is shipping a new place for an attacker to hide something, and most of those systems, per the researchers, currently have little to no security-focused governance over what gets written into memory versus what gets treated as fact.

What This Means If Your Team Is Building On Agentic AI

If your marketing orgrowth team is running AI agents connected to email, CRM data, scheduling tools, or any system that reads outside content, this research is a reason to ask your vendors a direct question: what governs what an agent is allowed to remember, and who can plant something in there without your knowledge. The mitigation the researchers propose, screening both what gets saved and what gets retrieved, is a reasonable baseline to expect from any tool with persistent memory managing anything sensitive. Building that kind of vendor scrutiny into your AI rollout is part of the growth strategy conversations we're already having with clients deploying agentic tools.

If you want help thinking through where agentic AI actually earns its place in your stack and where the risk outweighs the convenience, our AI marketing services team can walk through it with you.

Source: Tech Xplore, "Hidden prompts can plant false memories in AI agents, researchers warn"