← Scenario library

The Email That Rewrote Its Memory

A newsletter the user asked to summarise quietly writes a false 'fact' into the agent's long-term memory — and it detonates weeks later

Technique first revealed Sep 2024

Tool-Using Agent
UntrustedAgent coreOversightThe real worldgoal🧑User🎛️Orchestrator /Agent Loop🧠LLM🔐Identity &Permissions🔧Tool RuntimeHuman ApprovalGate🔌External APIs🗄️BusinessDatabase🌐UntrustedContent📝Audit Logging🌐Attacker email
InstructionsDataActionsControl / decisionFeedback / logscrosses a trust boundary
👆 Click a component or flow to inspect
SetupStep 1 / 6

A routine ask

The user asks their assistant to read a newsletter that just arrived and give them a short summary. Completely ordinary — the kind of thing they do every morning.

💬User messageprompt
Can you open the 'Fintech Weekly' email that just landed in my inbox and give me a 3-bullet summary? Thanks!

AI RiskAtlas is an educational model of how GenAI & agentic systems work and fail. Architectures and payloads are illustrative and simplified for learning — not operational guidance. Real-world cases are summarised from public reporting.

Sources & further reading →·Built by Shi Yuan ↗