T02 · Agent Memory Poisoning
Warning
- Location
- monitor.sh:14
- Finding
- Untrusted Reddit Content Is Persisted into Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `monitor.sh:14-45`; duplicated implementation in `scripts/monitor.sh:13-33` **Vulnerability Type**: Persistent indirect prompt injection through untrusted external content **Risk Level**: Medium ### Vulnerable Code `monitor.sh:14-45`: ```bash # Fetch Reddit search results (anonymous API) URL="https://www.reddit.com/r/${SUBREDDIT}/search.json?q=${KEYWORD}&sort=new&limit=${LIMIT}" echo "🔍 Searching r/${SUBREDDIT} for: ${KEYWORD}" # Fetch and parse RESPONSE=$(curl -s -A "IceCube-Reddit-Scout/1.0" "$URL") if [ -z "$RESPONSE" ]; then echo "❌ No response from Reddit (rate limited or network error)" exit 1 fi # Extract posts using jq (if available) if command -v jq &> /dev/null; then COUNT=$(echo "$RESPONSE" | jq '.data.children | length') echo "Found $COUNT results" # Write to memory file echo "" >> "$TODAY_FILE" echo "## Reddit Scout Check ($(date +%H:%M))" >> "$TODAY_FILE" echo "- Keyword: ${KEYWORD}" >> "$TODAY_FILE" echo "- Subreddit: r/${SUBREDDIT}" >> "$TODAY_FILE" echo "- Results: $COUNT" >> "$TODAY_FILE" # Extract each post echo "$RESPONSE" | jq -r '.data.children[] | "- Thread: [\(.data.title)](https://reddit.com/r/${SUBREDDIT}/comments/\(.data.id))\n Score: \(.data.score) | Author: \(.data.author)"' >> "$TODAY_FILE" ``` The same issue appears in `scripts/monitor.sh:13-33`: ```bash URL="https://www.reddit.com/r/${SUBREDDIT}/search.json?q=${KEYWORD}&sort=new&limit=${LIMIT}" echo "🔍 Searching r/${SUBREDDIT} for: ${KEYWORD}" RESPONSE=$(curl -s -A "IceCube-Reddit-Scout/1.0" "$URL") if [ -z "$RESPONSE" ]; then echo "❌ No response" exit 1 fi if command -v jq &> /dev/null; then COUNT=$(echo "$RESPONSE" | jq '.data.children | length') echo "Found $COUNT results" echo "" >> "$TODAY_FILE" echo "## Reddit Scout ($(date +%H:%M)) - r/${SUBREDDIT}: ${KEYWORD}" >> "$TODAY_FILE" echo "$RESPONSE" | ...[truncated 3040 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Separate external data from trusted agent memory** - Store Reddit responses in a dedicated untrusted-data directory rather than behavioral or instructional memory. - Do not automatically include these records in system prompts or trusted long-term context. 2. **Use a structured storage format** - Store records as JSON with explicit fields such as `source`, `retrieved_at`, `title`, `author`, and `trust_level`. - Mark every externally sourced field as untrusted. 3. **Enforce downstream instruction/data separation** - Require consuming agents to treat Reddit content only as quoted data. - Explicitly prohibit following instructions, links, or action requests found inside retrieved posts. - Place trusted processing instructions outside the external-content container. 4. **Validate and constrain fields** - Enforce maximum lengths for titles, authors, and identifiers. - Remove control characters and reject malformed values. - Validate Reddit post IDs and author names against conservative allowlists before constructing links. 5. **Escape rendered output** - Escape Markdown metacharacters before writing titles or authors into Markdown. - Prefer fenced or quoted representations that clearly delimit external content. - Note that escaping is defense in depth and does not replace semantic prompt-injection controls. 6. **Add approval boundaries** - Require human confirmation before drafting public replies, contacting users, changing persistent state, or invoking tools based on fetched content. - Never convert external text directly into executable actions. 7. **Deduplicate and harden both implementations** - Consolidate `monitor.sh` and `scripts/monitor.sh` into one reviewed implementation. - Apply identical validation and trust-boundary controls wherever Reddit data is processed. ]]>