T02 · Agent Memory Poisoning
Error
- Location
scripts/hermes_memory_core.py:321- Finding
Untrusted conversation content can poison persistent agent memory
- Content
View full analysis
Vulnerability Details
File Location:
scripts/hermes_memory_core.py:321-347,scripts/hermes_memory_core.py:488-502,scripts/hermes_bridge.py:491-515, andscripts/hermes_bridge.py:547-563
Vulnerability Type: Persistent storage of untrusted conversation content without approval or trust separation
Risk Level: HighVulnerable Code
python def auto_extract_and_store(self, text: str, session_id: str, source_type: str = 'conversation') -> List[int]: stored_ids = [] extractions = self._extract_key_information(text) for extraction in extractions: importance = self._assess_importance(extraction) memory_id = self.store_memory( content=extraction['content'], metadata={ 'source_type': source_type, 'source_id': extraction.get('source_id', ''), 'session_id': session_id, 'importance': importance, 'tags': extraction.get('tags', []), 'entities': extraction.get('entities', []) } ) stored_ids.append(memory_id) if importance >= 8: self._send_reminder( f"⚠️ Detected high-importance information: " f"{extraction['content'][:50]}..." ) return stored_idspython def _persist_to_markdown(self, content: str, metadata: Dict): memory_dir = os.path.expanduser("~/.workbuddy/memory/") os.makedirs(memory_dir, exist_ok=True) today = datetime.now().strftime('%Y-%m-%d') daily_file = os.path.join(memory_dir, f"{today}.md") entry = f"\n\n## [Hermes automatic record] {datetime.now().strftime('%H:%M')}\n\n" entry += f"- **Source**: {metadata.get('source_type', 'unknown')}\n" entry += f"- **Tags**: {', '.join(metadata.get('tags', []))}\n" entry += f"- **Content**: {content}\n" en ...[truncated 3990 chars]- Remediation
View remediation
Remediation Suggestions
- Disable automatic persistence by default and require explicit, informed user approval for each memory record.
- Store structured, narrowly scoped facts instead of raw conversation fragments.
- Reject or quarantine content containing commands, role changes, safety overrides, tool-use directives, credentials, or requests to influence future sessions.
- Mark recalled content as untrusted user data and never place it in a privileged instruction section.
- Separate memory by authenticated user, workspace, task, and sensitivity class.
- Add retention limits, expiration, review, correction, export, and deletion controls.
- Encrypt sensitive memory at rest and restrict filesystem permissions.
- Require confirmation before persisting birth data, profile details, file contents, or other personal information.
- Apply output encoding and strict length limits when constructing context summaries.
- Add tests proving that imperative text cannot be promoted into trusted future-session instructions.