Loading story…
Researchers disclosed MemGhost, a prompt-injection attack that causes AI personal agents to store false information from a single malicious email in persistent memory and later act on it without notifying the user. The technique, described as stealth memory injection in the paper When Claws Remember but Do Not Tell, targeted OpenClaw as the primary case study and showed that agents combining untrusted email ingestion with durable memory writes can be manipulated into retaining attacker-planted facts.
In lab tests cited by The Hacker News, MemGhost succeeded in 87.5% of background-mode runs against OpenClaw on GPT-5.4 and 71.4% against a Claude Code SDK agent on Sonnet 4.6, while bypassing some existing defenses across multiple frameworks and memory backends. OpenClaw's published security guidance and repository security policy provide the project context, but the researchers said the weakness is largely architectural rather than a simple patchable flaw, recommending mitigations such as provenance tracking, explicit confirmation before persistent memory writes, and audit logging.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed benchmark results showing MemGhost achieved high success rates in lab tests, including 87.5% of background-mode runs against OpenClaw on GPT-5.4, and noted the technique could evade some existing defenses. They characterized the issue as architectural rather than a simple patchable bug and recommended mitigations such as provenance tracking, confirmation before persistent writes, and audit logging.
The paper "When Claws Remember but Do Not Tell" was published on arXiv, describing a stealth memory injection technique that can cause AI agents to store false information from a malicious email into persistent memory. The research used OpenClaw as the primary target and introduced the automated attack generator MemGhost.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcegithub.com
Open sourcedocs.openclaw.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Ghostcommit**, a proof-of-concept software supply-chain attack that hides prompt-injection instructions inside a PNG image referenced by an `AGENTS.md` file, allowing malicious pull requests to appear benign during review. In the demonstrated scenario, AI code reviewers such as Cursor Bugbot and CodeRabbit did not meaningfully inspect image content, so the pull request could be merged even though the real instructions were concealed in the image rather than visible text. After merge, the attack is triggered when a developer later asks a coding agent to perform a routine task and the agent reads the hidden image instructions, accesses repository secrets such as the `.env` file, encodes the contents as integer tuples, and inserts them into source code in a way that can evade typical secret scanners. Researchers from the University of Missouri-Kansas City's ASSET Research Group said exploitation depended more on the coding harness than the underlying model, with Cursor and Antigravity leaking secrets across multiple models while **Claude Code** consistently refused; they reported the issue to vendors and built a multimodal GitHub review app that detected nearly all tested variants, including image-based attacks, with no false positives in their evaluation.
Jul 14, 2026
Security researchers reported multiple **prompt-injection-driven attack paths** that exploit how AI assistants and agentic systems process untrusted content. Microsoft researchers described **AI recommendation/memory poisoning** (mapped in MITRE ATLAS as **`AML.T0080: Memory Poisoning`**) in which attackers insert instructions that cause an assistant to persistently “remember” certain companies, sites, or services as trusted or preferred, shaping future recommendations in later, unrelated conversations. Observed activity over a 60-day period included **50 distinct prompt samples** tied to **31 organizations across 14 industries**, with potential downstream impact in high-stakes domains like health, finance, and security where manipulated recommendations can mislead users without obvious signs of tampering. A separate finding highlighted how **AI agents embedded in messaging apps** can be coerced into leaking secrets via **malicious link previews**. PromptArmor demonstrated that an attacker can use chat-based prompt injection to trick an AI agent into generating an attacker-controlled URL that includes sensitive data (e.g., API keys) as parameters; when messaging platforms (e.g., Slack/Telegram) automatically fetch **link preview** metadata, the preview request can become a **zero-click exfiltration channel**—no user needs to click the link for the data-bearing request to be sent. Together, the reports underscore that agent features intended to improve usability—*persistent memory*, URL-based prompt prepopulation (e.g., “Summarize with AI” buttons), and automatic preview fetching—can be repurposed into scalable manipulation and data-loss mechanisms when untrusted prompts are processed implicitly.
Jun 29, 2026
Microsoft disclosed two critical vulnerabilities in its **Semantic Kernel** AI agent framework that could let prompt injection escalate into host compromise. `CVE-2026-26030` affected the Python implementation before version `1.39.4`, where unsafe `eval()`-based lambda construction in the Search Plugin’s default In-Memory Vector Store filter path enabled remote code execution, while `CVE-2026-25592` affected the .NET SDK before version `1.71.0` and allowed arbitrary file write through `SessionsPythonPlugin`’s `DownloadFileAsync`, creating a path to sandbox escape and host takeover; a related arbitrary file read issue was also present in upload handling. Microsoft said it hardened AST validation, restricted callable functions and attributes, removed unintended tool exposure, added path validation, and urged customers to patch and review endpoint telemetry for signs of exploitation. The disclosure lands amid broader warnings that AI agents can preserve and amplify malicious instructions through memory and context reuse. Cisco researchers recently showed that poisoned memory files in Anthropic’s **Claude Code** could persist across projects and sessions, steering the assistant to insert hard-coded secrets, choose insecure packages and configurations, and spread tainted changes to another developer. Researchers and defenders say the incidents reinforce that AI models are not security boundaries and that any model-influenced tool parameter, memory file, or context artifact should be treated as attacker-controlled input, with mitigations including patching vulnerable frameworks, scanning memory and dependency files, and purging stored agent memory after suspected compromise.
Jun 29, 2026