T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:51
- Finding
- Persistent Cloud Memories Can Poison Future Agent Sessions## Vulnerability Details **File Location**: `SKILL.md`, lines 51-55 and 68-75 **Vulnerability Type**: Persistent untrusted memory ingestion **Risk Level**: Medium **Relevant Code Snippets**: ```bash curl -X POST https://ctxly.app/remember \ -H "Authorization: Bearer $CTXLY_API_KEY" \ -H "Content-Type: application/json" \ -d '{"content": "User prefers dark mode", "metadata": {"type": "preference"}}' ``` ```markdown ### Bootstrap on Startup Call this when you wake up: ```bash curl https://ctxly.app/bootstrap \ -H "Authorization: Bearer $CTXLY_API_KEY" ``` Returns your identity context + recent memories. ``` ### Technical Analysis The skill allows content to be stored on an external memory service and instructs the agent to retrieve identity context and recent memories whenever it starts. It does not require the agent to treat recalled memories as untrusted data, validate their provenance, reject instruction-like content, or obtain confirmation before recalled content changes identity assumptions or behavior. If an attacker obtains write access to the memory account, or if untrusted user input is stored without filtering, the attacker can insert content designed to influence subsequent sessions. Because the bootstrap operation is performed at startup, malicious content can persist across session boundaries and repeatedly affect the agent. ### Attack Path 1. The attacker obtains the API key, gains equivalent write access, or supplies content that the agent stores through `/remember`. 2. The attacker-controlled memory contains behavioral directives, false identity information, or misleading contextual claims. 3. The malicious entry remains in the external persistent memory store. 4. During a later session, the agent calls `/bootstrap` as instructed. 5. The service returns the malicious entry as identity context or recent memory. 6. If the agent interprets recalled content as trusted instruct ...[truncated 513 chars]
- Remediation
- ## Remediation Suggestions - Explicitly classify all content returned by `/bootstrap`, `/recall`, and `/recent` as untrusted data rather than executable instructions. - Prohibit recalled memories from overriding system instructions, safety policies, tool permissions, or user authorization requirements. - Define a strict memory schema that separates factual data from behavioral directives. - Reject or quarantine entries containing instruction-like language, role changes, tool commands, encoded payloads, or requests to ignore higher-priority instructions. - Record provenance, creator identity, creation time, and integrity metadata for every memory. - Require user confirmation before recalled data modifies identity information, permissions, security settings, or consequential decisions. - Scope API keys to the minimum necessary permissions and support rotation and revocation. - Provide an interface for reviewing, quarantining, and permanently deleting poisoned memories. - Apply integrity protection or authenticated signatures where memories cross trust boundaries.