T02 · Agent Memory Poisoning
Error
- Location
scripts/sync.js:124- Finding
Untrusted Shared Files Can Poison Persistent Agent Memory
- Content
View full analysis
f.endsWith('.md') && !f.startsWith('.')); for (const file of files) { const srcFile = path.join(srcDir, file); const destFile = path.join(destDir, file); if (!fs.existsSync(destFile)) { fs.copyFileSync(srcFile, destFile); syncReport.pulled.push(`${type}/${file}`); state.lastHash[file] = fileHash(srcFile); } } } ``` ### Technical Analysis The synchronization process treats every non-hidden Markdown file in the shared `team/project` and `team/reference` directories as trusted persistent memory. It copies those files into the Agent's `auto` memory directories without verifying the writer, validating provenance, inspecting the content, or obtaining user approval. If another workspace, user, process, or compromised Agent can write to the team directory, it can insert Markdown containing false facts, adversarial instructions, or persistent behavioral directives. The next synchronization imports that content into the Agent's long-term memory area, where it may influence future sessions. The filename restrictions only require the `.md` suffix and reject hidden names. They do not provide an authorization or content-integrity boundary. ### Attack Path 1. An attacker obtains write access to `~/.openclaw/workspace/memory/team/project` or `team/reference`, directly or through another synchronized Agent. 2. The attacker creates a file such as `project-policy.md` containing malicious instructions or deli ...[truncated 935 chars]- Remediation
View remediation