Research · curated 26 Jul 2026
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
GhostWriter demonstrates that long-term memory in personal AI agents that handle sensitive data and touch untrusted sources is a largely ungoverned attack surface, giving defenders both a concrete threat model and a candidate mitigation.
Researchers introduce GhostWriter, a memory-poisoning attack against tool-using personal LLM agents with long-term memory, operating in an injection phase (a hidden payload sent to the agent) and an activation phase (the poisoned memory being retrieved). The paper reports near-universal ~98% injection and ~60% activation rates against state-of-the-art agents, and proposes a defense, Agentic Memory Sentry (AM-Sentry), using a memory-saving policy and a memory-retrieval screen to reduce success while preserving utility.