T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:34- Finding
Unreviewed Persistent Agent Memory Modification
- Content
View full analysis
60%**: Save summary to `memory/YYYY-MM-DD.md` ``` ```markdown - [ ] Review recent daily notes - [ ] Update MEMORY.md with distilled learnings - [ ] Remove outdated info ``` ### Technical Analysis The skill instructs the agent to summarize current-session content into persistent daily memory and subsequently incorporate selected information into `MEMORY.md`. It also authorizes removal of information considered outdated. Because recent session content may include untrusted user input, retrieved documents, or prompt-injection material, automatically persisting a summary creates a cross-session trust-boundary violation. Malicious instructions can be transformed into apparently trusted memory and influence future agent behavior. The instruction to remove outdated information can additionally erase legitimate context or security guidance without review. No validation, provenance tracking, separation of data from instructions, approval gate, or rollback mechanism is specified. ### Attack Path 1. An attacker introduces malicious or misleading instructions into content processed during a session. 2. Session context usage exceeds the stated 60% threshold. 3. The heartbeat procedure summarizes the session, including attacker-influenced content, into `memory/YYYY-MM-DD.md`. 4. A later heartbeat reviews the daily note and distills its contents into `MEMORY.md`. 5. Future sessions consume the poisoned memory as persistent context. 6. The attacker-controlled guidance continues to affect later decisions, even after the original session has ended. 7. Legitimate contradictory information may be removed under the instruction to delete outdated material. ### Impact Assessment Successful exploitation can obtain pers ...[truncated 375 chars]- Remediation
View remediation