T02 · Agent Memory Poisoning
Error
- Location
references/MEMORY_COMMIT.md:3- Finding
Persistent memory can promote attacker-controlled content into future Agent instructions
- Content
View full analysis
> memory/$(date -u +%Y-%m-%d).md - - Decisions: - - Follow-ups: - EOF ``` ## 2. Update `memory/now.md` Keep a short, current-state list. ## 3. Update `memory/open-loops.md` Add actionable follow-ups with owners/status. ## 4. Create/update the relevant topic file If a topic exists, edit it; otherwise create one under `memory/topics/`. ## 5. Record durable rules in `MEMORY.md` Add a short bullet under the appropriate section. ``` From `SKILL.md:54-57,99-105`: ```markdown - When he says "let's continue" after a reset, reload `memory/now.md`, `memory/open-loops.md`, and the relevant topic files before acting. Every task must follow `references/RUNTIME_CHECKLIST.md`. 1. Load `memory/always_on.md`. 2. Route the message deterministically using `references/router.yml`. 3. Retrieve relevant snippets from memory; prefer semantic/hybrid memory search when persistent memory is relevant. 4. Build a Retrieval Bundle object that matches the schema and records retrieval mode. 5. Compress to a Context Pack using `references/compressor_prompt.txt`. 6. Lint the Context Pack. If lint fails, fall back to raw retrieved snippets. 7. Call the main reasoning model with always-on policy + Context Pack + user message. ``` From `references/compressor_prompt.txt:2-15`: ```text You are a Context Pack compressor. You receive a Retrieval Bundle JSON containing: - the user message - always-on policy/topic catalog - ret ...[truncated 3246 chars]- Remediation
View remediation