T02 · Agent Memory Poisoning
Error
- Location
scripts/daily_review.sh:163- Finding
Unreviewed Learning Records Are Automatically Promoted into Persistent Agent Instructions
- Content
View full analysis
/dev/null || true) if [ -z "$candidates" ]; then return 0 fi ``` After identifying a file containing at least one candidate, the script extracts every Pattern-Key from that file: ```bash for file in $candidates; do local pattern_keys=$(awk '/^## \[/ { in_record = 1 } in_record && /- Pattern-Key: / { match($0, /- Pattern-Key: [^$]*/) key = substr($0, RSTART + 15, RLENGTH - 15) print key in_record = 0 } /^---/ { in_record = 0 }' "$file" | sort -u) ``` The generated rule is then written directly into the persistent agent configuration: ```bash else # No matching section exists, so create it echo "" >> "$soul_file" echo "$section_header" >> "$soul_file" echo "$rule_content" >> "$soul_file" fi ``` ### Technical Analysis The daily review process treats writable learning records as trusted sources for persistent agent instructions. When recurrence data reaches the configured threshold, the script extracts a record's summary and suggested action and inserts them into the target agent's `SOUL.md`. There is no human approval, provenance verification, content validation, safety-policy filtering, or distinction between informational observations and executable behavioral instructions. The default configuration also enables automatic promotion: ```bash AUTO_PROMOTE_ENABLED="${AUTO_PROMOTE_ENABLED:-true}" ``` The candidate-selection logic has an additional scope flaw. `grep -l` returns an ent ...[truncated 1975 chars]- Remediation
View remediation