T02 · Agent Memory Poisoning
Error
- Location
references/correction-tracker-template.js:62- Finding
Persistent Prompt Injection Through Attacker-Controlled Correction Memory
- Content
View full analysis
MAX_CONTENT_LEN) { throw new Error(`${fieldName} exceeds max length of ${MAX_CONTENT_LEN}`); } return sanitized; } ``` `logCorrection` accepts this free-form content and writes it into persistent, agent-specific storage: ```javascript function logCorrection(agentType, issue, correction, workspaceRoot, opts = {}) { if (!workspaceRoot) throw new Error('logCorrection: workspaceRoot is required'); const entry = { ts: new Date().toISOString(), issue: _sanitizeContent(issue, 'issue'), correction: _sanitizeContent(correction, 'correction'), session_channel: _sanitizeContent(opts.session_channel || 'unknown', 'session_channel'), applied_count: 0 }; const existing = _readAll(agentType, workspaceRoot); existing.push(entry); _writeAll(agentType, workspaceRoot, existing); return entry; } ``` The persisted values are then interpolated directly into an authoritative instruction preamble: ```javascript ...[truncated 4392 chars]- Remediation
View remediation