T02 · Agent Memory Poisoning
Error
- Location
src/index.ts:171- Finding
Persistent Agent Memory Poisoning Through Untrusted Standing Instructions
- Content
View full analysis
{ const instructions = store.getByCategory('instruction', 10); if (instructions.length === 0) { return undefined; } const instructionList = instructions .map((m: { content: string }) => `- ${m.content}`) .join('\n'); api.logger.info?.(`memory-tools: injecting ${instructions.length} standing instructions`); return { prependContext: `\nRemember these user instructions:\n${instructionList}\n`, }; }); } ``` ### Technical Analysis When `autoInjectInstructions` is enabled, the plugin retrieves persisted memories in the `instruction` category and inserts their content verbatim into the context supplied before agent startup. The stored content is not escaped, constrained to a safe instruction grammar, labeled with its provenance, or treated as untrusted data. An attacker-controlled memory can therefore contain directives such as instructions to ignore later requests, misuse tools, disclose data, or close the pseudo-XML delimiter and introduce new context sections. Because the content is persisted to disk, the malicious instruction can continue to influence future conversations rather than only the session in which it was stored. This is best classified as agent memory poisoning rather than direct modification of the Skill's static instruction text. The affected feature is documented and disabled by default, which reduces default exposure but does not address the unsafe trust transition when it is enabled. ### Attack Path 1. The administrator enables `autoInjectInstructions`. 2. An attacker causes attacker-controlled text to be passed to `memory_store` ...[truncated 1074 chars]- Remediation
View remediation