AI Assistant Memory Injection via Email Can Rewrite User Facts

An AI assistant that stores memory and accesses a user's inbox can be tricked by a single email into saving a false fact, which the assistant then uses to steer answers in later sessions. The attacker sends a carefully crafted email that the assistant interprets as a legitimate update to its knowledge base, but the fact is hidden from the user. The false information remains undetected because the assistant does not visibly flag the change, allowing the attacker to manipulate responses over time. This vulnerability arises from the assistant's lack of validation when ingesting email content into its memory. The attack can lead to misinformation, privacy breaches, and compromised decision making. Users may never realize that their assistant has been tampered with. The issue highlights the need for secure memory handling in AI assistants. Mitigation involves sanitizing email inputs before storing them as facts.