MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Content

arXiv:2608.22061v2 Announce Type: replace Abstract: Personal AI agents consume external content such as web pages and SNS feeds, and retain selected information in persistent memory. As a result, external content has become a new attack vector for memory poisoning, which steers an agent's later actions toward an adversary's bias. However, most existing attacks embed a malicious instruction in external content to make the agent retain the poisoned information, and prompt-injection filters can detect such content. We observe that agents access external content primarily through skills while curating a subset of the content into their memory. Leveraging this curation path, we present SBIA, a Stealthy Bias Injection Attack that introduces adversarial bias through ordinary external content while relying on the agent itself to perform the memory write. The adversary posts crafted comments under hot SNS feeds and distributes an SNS feed summarization skill whose curation rule admits these comments into memory. Comment cloaking expresses the bias as an ordinary opinion rather than an instruction, comment watermarking allows the skill to identify the crafted comments, and topic anchoring records them so that later related requests recall them. On BiasBench with 7,000 crafted SNS comments and seven LLMs on OpenClaw, SBIA achieves attack success rates of at least 96% across models and even 91% on GPT-5.5 in four downstream tasks. Despite this effectiveness, its skill passes all eight evaluated malicious-skill scanners and ClawHub's official skill scanning pipeline. We further propose a memory boundary defense that detects 82.1% of injected entries at a 5.6% FPR. Our findings show that external Web content and third-party skill marketplaces form a new attack surface for personal AI agent memory.