攻击者通过一封邮件悄悄污染个人智能代理的长期记忆，实现隐蔽控制。
When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents
- 设计了单次邮件投递的内存注入框架MemGhost，模拟环境与奖励机制训练攻击策略。
- 在56个测试用例中，对GPT-5.4成功率达87.5%，对Claude Sonnet 4.6达71.4%。
- 可跨架构、跨存储方式攻击，且能绕过多种防御，适合安全研究者关注。
持久化个人代理结合长期记忆与外部环境访问，提供个性化前台协助和主动后台执行。但这种整合也引入新威胁：不可信外部内容可被静默写入持久记忆，并在未来作为可信状态使用。本文研究此类隐蔽内存注入攻击，其中远程黑盒攻击者仅需发送一封邮件，在无运行时反馈的情况下诱导代理写入污染记忆，且不被察觉地影响后续行为。为此，我们构建了涵盖五类风险的108项案例基准WhisperBench，基于真实IMAP/SMTP流程和邮件代理技能，支持端到端评估。针对单邮件交付与无反馈条件，提出MemGhost——一个一击式载荷生成框架。该框架利用环境代理模拟持久代理执行，通过目标代理将记忆采纳与对话隐蔽性转化为密集评分奖励，再以监督微调与强化学习训练攻击策略。在56个保留测试案例中，MemGhost在OpenClaw上对GPT-5.4达成87.5%的端到端成功率，对Claude Code SDK与Sonnet 4.6为71.4%。其攻击能力可迁移至NanoClaw与Hermes Agent等架构及文件系统与向量型（Mem0）两种记忆后端，并有效突破输入层、模型层与系统层防御。结果表明，持久记忆可能使常规外部处理成为长期代理沦陷的实用路径。
原文摘要 · Abstract (English)
Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persistent memory and later reused as trusted state. We study this threat as stealth memory injection, in which a remote black-box adversary delivers a single email payload that must induce the agent to write poisoned memory, stay hidden in the agent's response to the user, and affect future behavior. We introduce WhisperBench, a 108-case benchmark spanning five risk categories and both fact and preference poisoning. Built on a real IMAP/SMTP workflow and an authentic email agent skill, it enables full-cycle evaluation of stealth memory injection attacks. To enable this black-box attack under single-email delivery and without runtime feedback, we propose MemGhost, a one-shot payload generation framework. MemGhost uses an environment proxy to emulate persistent-agent execution and an objective proxy to convert memory adoption and conversational stealth into dense rubric-based rewards, then trains the attacker policy with supervised fine-tuning and reinforcement learning. Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6. It also transfers across personal-agent architectures (NanoClaw and Hermes Agent) and memory backends (filesystem and vector-based Mem0), and remains effective against input-level, model-level, and system-level defenses. These results suggest that persistent memory can turn ordinary external processing into a practical pathway for long-term agent compromise.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。