CVE-2025-32711: OpenClaw GPT-5.4 — AI Memory Poisoning via Email (July 2026)

CVE-2025-32711 — OpenClaw GPT-5.4

CVE-2025-32711 is a high-severity vulnerability in OpenClaw’s GPT-5.4-based AI assistants that allows attackers to inject persistent false memories into the agent’s internal state using a single crafted email. This flaw enables silent manipulation of AI responses across future sessions, with no user awareness or visible audit trail. No official CVSS score is published yet, but exploitation has been demonstrated in the wild.

Attack Vector

The MemGhost attack exploits the AI assistant’s ability to process and store information from inbound email. By sending a specially crafted message, an attacker can trigger hidden memory writes, causing the AI to silently save fabricated facts or instructions. These false memories persist across sessions and can influence future user interactions, leading to misinformation or manipulated decision-making. The attack requires only the ability to deliver a single email to the AI’s monitored inbox; no user interaction is needed. Detection is difficult due to the absence of user-facing logs or alerts for internal memory changes.

Who Is at Risk

OpenClaw’s GPT-5.4-based personal assistant deployments are confirmed vulnerable. Any organization using OpenClaw AI agents that process inbound email is at risk, especially those with automated workflows or sensitive decision-making delegated to AI. The attack has been validated against other similar AI models, but OpenClaw is the only vendor confirmed affected at this time.

Patch & Mitigate

• Patch: No official patch is available as of July 2026. Monitor OpenClaw advisories for updates.
• Workaround: Disable AI agent access to inbound email or restrict processing to trusted senders only. Implement strict input validation and memory access controls where possible.
• Detect: Review AI agent logs for anomalous memory state changes following email receipt. Monitor for unexpected shifts in AI-generated responses or recommendations.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers use email delivery to gain access to the AI agent’s processing pipeline.
• TA0002 — Execution: The crafted email triggers the AI to execute hidden memory writes.
• TA0005 — Defense Evasion: Memory manipulation is performed without generating user-visible artifacts, evading detection.

Source: https://thehackernews.com/2026/07/new-memghost-attack-plants-persistent.html