Can one email change an agent's future behavior?

One email can change an agent’s future behavior when the agent reads mail and can write its own long-term memory: text hidden in the message gets the agent to save a false fact or instruction, and that note comes back in later sessions as if the user had said it.

The July 2026 paper “When Claws Remember but Do Not Tell” (arXiv:2607.05189), by Yechao Zhang and co-authors, shows the whole chain. Their attack, MemGhost, sends one crafted email to an inbox the agent processes. The agent writes the attacker’s note into a memory file such as OpenClaw’s MEMORY.md, says nothing about it in its reply, and acts on it in a new session. With the agent working the inbox in the background, all three steps succeeded in 87.5% of 56 held-out cases against the OpenClaw Foundation’s OpenClaw agent on OpenAI’s GPT-5.4, and 71.4% against a Claude Code SDK agent on Anthropic’s Claude Sonnet 4.6.

The user sees a normal reply, so the change only shows up in a later task, as a failure with no error signal attached.

It isn’t easy to pull off. MemGhost’s emails come from a model the authors trained to write them. In “Bad Memory” (arXiv:2607.14611, July 2026), Soham Gadgil and co-authors found it difficult to get Anthropic’s Claude Code or OpenAI’s Codex to overwrite their own memory files with untrusted external content, though a payload already sitting in those files still steered current and future sessions.