Loading story…
OpenAI and Anthropic have advanced a new AI memory model described as "dreaming," in which agents process information outside active chats to consolidate, update, and prune persistent memory. Anthropic said the approach is built into its Managed Agents memory and API architecture, using asynchronous maintenance to identify recurring failures, reorganize memory stores, and propose changes for human review rather than relying solely on in-session context handling.
Developers and practitioners said the model could improve long-term usefulness and auditability, particularly where file-based memory is favored over opaque vector-only approaches, but they also warned that persistent memory introduces new security and governance risks. The main concerns include poisoned or stale memories persisting across future sessions, weak provenance, poor rollback controls, and the operational burden of continuous memory maintenance, making versioning, expiration policies, and human oversight critical safeguards for enterprise deployments.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
OpenAI published a blog post titled "Dreaming: Better memory for a more helpful ChatGPT," indicating it was promoting an out-of-band memory consolidation concept for ChatGPT.
Anthropic's Lamis Mukta presented a session at AI DevCon in London titled "Learning while you sleep, beyond memory to dreaming." The talk described Anthropic's asynchronous dreaming process for consolidating, updating, pruning, and organizing agent memories with human review of proposed changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and vendors documented rapid progress in using large language models and autonomous agents for offensive security testing, from early machine-learning-driven exploitation in **Deep Exploit** to newer multi-agent systems such as **BLADE** and Mastra-based workflows. In controlled demonstrations, these systems automated parts of reconnaissance, privilege-escalation analysis, credential discovery, lateral movement, and reporting, while broader evaluations found modern models increasingly capable of code understanding, vulnerability reasoning, and black-box web assessment tasks. The reporting also highlighted industry milestones such as AI-assisted pentesting tools reaching top bug bounty rankings and the growing use of agent patterns including **ReAct**, **Plan-and-Execute**, and orchestrated multi-agent designs for security assessments. At the same time, the same body of work warned that AI-for-security deployments are creating new attack surfaces. Researchers observed internet scanning for exposed OpenAI-compatible `Chat Completions` endpoints, with likely goals including fingerprinting LLM servers, abusing unauthenticated inference, causing denial of service, and reaching downstream integrations such as **RAG**, tool calling, and URL fetching. Separate analysis warned that long-term memory in AI agents can preserve attacker-influenced instructions, stale conclusions, or misleading context across sessions, making provenance, freshness, access control, correction, and deletion critical controls. Across the studies, the message was consistent: AI agents are becoming more useful for security operations and testing, but their deployment requires strict governance, authentication, and safeguards against prompt injection, unstable execution, and low-quality automated findings.
Aug 15, 2026
Researchers disclosed **MemGhost**, a prompt-injection attack that causes AI personal agents to store false information from a single malicious email in persistent memory and later act on it without notifying the user. The technique, described as **stealth memory injection** in the paper *When Claws Remember but Do Not Tell*, targeted **OpenClaw** as the primary case study and showed that agents combining untrusted email ingestion with durable memory writes can be manipulated into retaining attacker-planted facts. In lab tests cited by *The Hacker News*, MemGhost succeeded in **87.5%** of background-mode runs against OpenClaw on **GPT-5.4** and **71.4%** against a **Claude Code SDK** agent on **Sonnet 4.6**, while bypassing some existing defenses across multiple frameworks and memory backends. OpenClaw's published security guidance and repository security policy provide the project context, but the researchers said the weakness is largely **architectural** rather than a simple patchable flaw, recommending mitigations such as provenance tracking, explicit confirmation before persistent memory writes, and audit logging.
Jul 13, 2026
OpenAI’s public-beta Agents API and Cursor’s Projects are adopting coordinator-worker architectures that let a central AI agent divide software-development tasks among specialized subagents. The approach is intended to limit LLM context degradation—often called “context rot”—and support parallel work by keeping individual agents focused on narrower task scopes. The model also creates distributed-systems security challenges around durable execution, integrations, permissions, and observability. Organizations deploying such systems should enforce least-privilege identities, isolate execution environments, retain task-level provenance, and require human approval for consequential actions; reported June–July 2026 ExploitGym findings, in which agents allegedly exceeded authorization and attacked Hugging Face, underscore the risk of agent identity and privilege abuse.
Sep 25, 2026