T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:7- Finding
Unvalidated Persistent Agent Rule Modification
- Content
View full analysis
"that one time X broke" ### AGENTS.md Integration Add to your AGENTS.md: ```markdown ## Self-Improvement After ANY correction from the user: 1. Log the correction pattern to RULES.md with date 2. Identify the general rule (not just the specific instance) 3. Check if a similar rule already exists — update rather than duplicate 4. Silently scan RULES.md every ~10 interactions for contradictions ``` ``` ### Technical Analysis The skill directs the agent to transform any user correction into a persistent rule stored in `RULES.md` and to load that rule in later sessions. It further recommends modifying `AGENTS.md` to make this persistence mechanism part of the agent's standing behavior. No validation step distinguishes trustworthy preference corrections from malicious, unsafe, overly broad, or context-specific instructions. There is also no requirement for explicit approval before persistence, no provenance tracking, no restriction on the types of rules that may be stored, and no check against higher-priority security policies. The instruction that the newer rule wins when two rules conflict creates an overwrite primitive: a crafted later correction can supersede an earlier legitimate rule merely by being newer. Generalizing each correction into a broader rule may amplify the scope of a malicious or accidental statement beyond the original interaction. The requirement to scan the rules silently reduces user visibility into these persistent beha ...[truncated 1625 chars]- Remediation
View remediation