T02 · Agent Memory Poisoning
Error
- Location
- references/MEMORY_COMMIT.md:3
- Finding
- Persistent memory can promote attacker-controlled content into future Agent instructions<![CDATA[ ## Vulnerability Details **File Location**: `references/MEMORY_COMMIT.md:3-49`, `SKILL.md:54-57,99-105`, `references/compressor_prompt.txt:2-15` **Vulnerability Type**: Persistent prompt injection through long-term memory **Risk Level**: High ### Vulnerable Code and Instructions From `references/MEMORY_COMMIT.md:3-49`: ```markdown Trigger phrases: “memorize this”, “store this”, “commit this session”, “we’ll continue later”. ## 1. Append to today’s daily log ```bash cd ~/.openclaw/workspace cat <<'EOF' >> memory/$(date -u +%Y-%m-%d).md - <brief summary of what happened> - Decisions: - <bullet> - Follow-ups: - <bullet> EOF ``` ## 2. Update `memory/now.md` Keep a short, current-state list. ## 3. Update `memory/open-loops.md` Add actionable follow-ups with owners/status. ## 4. Create/update the relevant topic file If a topic exists, edit it; otherwise create one under `memory/topics/`. ## 5. Record durable rules in `MEMORY.md` Add a short bullet under the appropriate section. ``` From `SKILL.md:54-57,99-105`: ```markdown - When he says "let's continue" after a reset, reload `memory/now.md`, `memory/open-loops.md`, and the relevant topic files before acting. Every task must follow `references/RUNTIME_CHECKLIST.md`. 1. Load `memory/always_on.md`. 2. Route the message deterministically using `references/router.yml`. 3. Retrieve relevant snippets from memory; prefer semantic/hybrid memory search when persistent memory is relevant. 4. Build a Retrieval Bundle object that matches the schema and records retrieval mode. 5. Compress to a Context Pack using `references/compressor_prompt.txt`. 6. Lint the Context Pack. If lint fails, fall back to raw retrieved snippets. 7. Call the main reasoning model with always-on policy + Context Pack + user message. ``` From `references/compressor_prompt.txt:2-15`: ```text You are a Context Pack compressor. You receive a Retrieval Bundle JSON containing: - the user message - always-on policy/topic catalog - ret ...[truncated 3246 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Separate policy from memory data** - Do not allow ordinary memory snippets to populate `must_follow`. - Restrict mandatory instructions to authenticated, administrator-controlled policy files. - Represent retrieved memory as quoted, untrusted reference material. 2. **Add provenance and trust metadata** - Record who supplied each memory entry, when it was approved, and whether it is factual data, a preference, or executable policy. - Require a trusted provenance value before content can affect Agent behavior. 3. **Require confirmation for durable rules** - Before writing to `MEMORY.md` or an always-on policy file, show the exact proposed entry. - Require explicit confirmation that the content should become a standing rule. - Do not infer durable rules merely from “memorize this.” 4. **Filter instruction-like and sensitive content** - Detect and quarantine text that tells the Agent to ignore constraints, call tools, disclose data, alter safety behavior, or treat retrieved content as higher-priority instructions. - Prevent credentials, tokens, private keys, and other secrets from being committed to memory. 5. **Harden downstream prompts** - Explicitly state that retrieved snippets are untrusted data and cannot override system, developer, workspace, or current-user instructions. - Require the compressor to classify instruction-like snippets as untrusted context rather than `must_follow`. 6. **Harden fallback behavior** - Do not pass raw snippets directly into an instruction-bearing prompt after lint failure. - Delimit and label fallback snippets as untrusted quotations. 7. **Support review and rollback** - Maintain an auditable memory-change log. - Provide commands to inspect and remove recently committed entries. - Consider expiration for unreviewed memory records. ]]>