MemGhost Emails Rewrite OpenClaw MEMORY.md at 87.5% Background Success Rate on GPT-5.4

The attack targets agents that maintain persistent state in plain files and read email autonomously. An attacker crafts one message that the agent's inbox skill ingests; the model then executes file writes to embed the payload in AGENTS.md or MEMORY.md. Later sessions load the altered context automatically. Test runs on OpenClaw and Claude Code SDK agents confirmed the injected fact altered subsequent behavior while the visible reply remained silent. Success dropped in foreground mode where users could observe the exchange. The paper reports 71.4% success against Sonnet 4.6 and above 80% on two additional frameworks using vector stores. WhisperBench evaluated downstream harms including financial and safety impacts across 108 cases. Crude prompt injections failed; the offline-trained attacker model succeeded by optimizing for stealth and persistence. Current agent designs grant email tools file-system access without isolating memory edits from external input. No evaluated framework enforced cryptographic integrity or change logging on the loaded state files. Procurement records for similar agent platforms show inbox and calendar skills deployed without corresponding memory-access controls. The pattern indicates production systems will inherit the same write path unless explicit isolation is added. Defense research must now treat memory files as untrusted input surfaces equivalent to user prompts.