AIBRIEF
A 2025 peer reviewed AI security paper (MINJA, a memory injection attack) shows the trick can sit dormant in an assistant's memory for weeks — and the attack class is already expanding to email, with January 2026 research flagging its success rates
A user asks their AI assistant what to do when a flight is canceled. The assistant confidently recommends a phone number, one it "learned" weeks earlier from a line of hidden text on a travel page the user never saw. Forcepoint X-Labs calls this persistent memory poisoning, and says the attack has been demonstrated against ChatGPT, Gemini, Claude, and Microsoft 365 Copilot.
An attacker hides a short instruction in a webpage (text sized to zero, off-screen, or the same color as the background), and the assistant's text extractor reads it like any other prose. The assistant files the line as a durable fact, retrieves it weeks later in an unrelated task, and serves it as confident advice. The academic version is MINJA (Memory INJection Attack), a NeurIPS 2025 paper that assumed no memory-store access, no elevated privileges, no system compromise, only ordinary queries through the standard interface. Independent researcher Christian Schneider's "Memory poisoning in AI agents: exploits that wait" corroborates the persistence framing.
MINJA's reported injection success above 95% and attack success above 70% come from a controlled setup, and a January 2026 evaluation in electronic health record agents flags those numbers as potentially optimistic. The threat is real; the precise hit rates are not settled.
Microsoft Security described "AI Recommendation Poisoning" in February 2026, and The Hacker News reported MemGhost in July 2026, a single email that plants a persistent false memory. Web pages are no longer the only door.
Treat any recalled "fact" as untrusted until the assistant shows its source, and ask vendors for visible provenance on memory writes. Assistant memory is now part of the user's attack surface.