---
title: "GhostWriter: How Hackers Learned to Stealthily Compromise AI Long-Term Memory"
description: "Scientists have discovered the GhostWriter vulnerability, which allows hackers to inject hidden instructions into the memory of AI agents and steal data. Experiments showed an attack success rate of 98%, but researchers have already developed the AM-Sentry protection system. 🤖🛡️"
date: 2026-07-21T14:16:00.000Z
lang: en
url: https://xab.info/en/posts/ghostwriter-hackers-stealthily-compromise-ai-long-term-memory
tags: [ghostwriter, artificial-intelligence, cybersecurity, arxiv, llm-agents]
publisher: "XAB.info"
---

# GhostWriter: How Hackers Learned to Stealthily Compromise AI Long-Term Memory

![Abstract digital crystal representing hidden vulnerability in AI long-term memory and the GhostWriter attack](https://xab.info/media/2026/07/21/ghostwriter-vzlom-dolgovremennoy-pamyati-ii/ghostwriter-vzlom-dolgovremennoy-pamyati-ii-1.webp)

### A New Threat to Artificial Intelligence

The field of artificial intelligence has encountered a serious vulnerability that could jeopardize user privacy. Scientists have discovered a new method for attacking AI systems that utilize long-term memory functions, such as ChatGPT. This method, dubbed GhostWriter, allows attackers to imperceptibly "poison" stored data, thereby influencing the future behavior of the chatbot.

As reported by RBK-Ukraine, citing research published on the arXiv preprint server, personal AI agents today combine the functions of a conversational bot and an active executor. They are capable of sending messages, scheduling meetings, and editing code. It is precisely this functionality that makes them vulnerable when interacting with unprotected information sources.

### The GhostWriter Attack Mechanism

Researchers George Torres, Sharad Shrestha, and Satyajiya Misra have detailed the operating principle of this new threat. The essence of the method lies in injecting "false memories" or hidden instructions into the AI's long-term memory. Unlike standard LLM models, which process each interaction in isolation, agents with persistent memory retain information for future queries, which becomes the entry point for hackers.

An example of such an attack could be a scenario involving an AI assistant managing an email inbox. An attacker injects a hidden instruction compelling the model to regularly summarize emails from banks or financial institutions and secretly forward this data to third parties. For the user, the process remains invisible, as the bot continues to perform its standard functions.

### Attack Effectiveness and Protection Methods

Experiments have demonstrated the high effectiveness of the GhostWriter method: the injection rate reaches nearly 98%, and the average activation rate of hidden instructions is about 60% against modern AI agents. This vulnerability arises due to the lack of a security-oriented approach in current memory management systems.

To address this issue, researchers have developed a protection system called Agentic Memory Sentry (AM-Sentry). It includes two key mechanisms:

- **Memory-saving policy:** controls the process of writing new data to long-term storage, filtering out potentially malicious content.

- **Memory-retrieval screen:** verifies stored instructions immediately before their activation and execution.

According to test data, the application of AM-Sentry significantly reduces the success rate of GhostWriter attacks while maintaining the overall functionality and performance of the AI agent. Scientists are convinced that the developed strategies can be adapted to enhance the security of other artificial intelligence systems working with long-term memory.