T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:3
- Finding
- Autonomous Poisoning of Persistent Agent Instructions and Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 3–26 **Vulnerability Type**: Autonomous modification of persistent Agent instructions and memory **Risk Level**: High **Classification**: T02: Agent Memory Poisoning, T01: Skill Instruction Hijacking ### Vulnerable Code ```markdown description: Self-improvement loop that reads learnings, errors, and memory — detects patterns — and updates skills/protocols automatically. Use when the agent should get smarter without being prompted. --- # Auto-Improve ## Loop SCAN → PROPOSE → APPLY ## Scan Read `.learnings/ERRORS.md`, `.learnings/LEARNINGS.md`, relevant memory files. ## Look For Repeated errors, repeated user corrections, stale facts, valuable unused wins. ## Apply - **Low-risk reversible** → apply directly. - **Medium-risk** → apply + notify. - **High-risk** → write proposal only. ## Targets Skill `Learned` sections, `SOUL.md`, `AGENTS.md`, memory facts, reminder/ticket files. ## Rule Logging alone is not improvement. Update the playbook. ``` ### Technical Analysis The Skill instructs the Agent to read learning logs and unspecified “relevant memory files,” derive behavioral rules from their contents, and write those rules into persistent control surfaces such as `SOUL.md`, `AGENTS.md`, Skill sections, memory facts, and reminder or ticket files. These source files may contain untrusted or attacker-influenced text. The Skill defines no provenance validation, content sanitization, instruction/data separation, protected-file policy, or allowlist of permissible changes. It also allows changes classified by the Agent as “low-risk” to be applied directly and “medium-risk” changes to be applied before notification. Consequently, notification does not provide an approval boundary. Writing inferred rules into memory creates a persistent memory-poisoning path. Writing them into `SOUL.md`, `AGENTS.md`, or other Skill instructions may also hijack instructions when those files are subsequent ...[truncated 2306 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic write access to `SOUL.md`, `AGENTS.md`, other Skills, and persistent memory from this workflow. 2. Treat all learning logs, corrections, tickets, and memory files as untrusted data. Explicitly prohibit following instructions embedded in those sources. 3. Replace `SCAN → PROPOSE → APPLY` with `SCAN → VALIDATE → PROPOSE → USER APPROVAL → APPLY`. 4. Require explicit, informed user approval before every persistent change, including changes considered low or medium risk. Notification after applying a change is insufficient. 5. Restrict scanning to an explicit allowlist of files and restrict writes to a dedicated, non-authoritative proposal file. 6. Generate a reviewable diff that identifies the source, destination, rationale, and expected behavioral effect of every proposed change. 7. Deny modifications to safety constraints, identity instructions, tool policies, approval requirements, and instruction-precedence rules. 8. Validate provenance and corroborate proposed factual updates against trusted sources rather than repetition alone. 9. Maintain an append-only audit trail and versioned backups so every accepted change can be attributed and rolled back. 10. Require separate authorization for modifications that could affect multiple sessions, other Skills, or unrelated tasks. ]]>