T02 · Agent Memory Poisoning
Error
- Location
assets/founder-profile-template.md:38- Finding
Persistent instruction injection through the Founder Profile user_notes section
- Content
View full analysis
{{USER_NOTES}} ``` The profile-processing instructions reinforce that content from this persistent field must immediately affect agent behavior: ```markdown ## The Sacred user_notes Section The `user_notes` section is for the founder's manual input and is **off-limits** to AI modification. 1. **AI Respect**: If a founder writes "I am pivoting to enterprise" in `user_notes`, the AI must update its context immediately. 2. **Separation**: Insights derived from AI analysis must be kept in the `ai_observations` or `growth_logs` sections. 3. **Synthesis**: AI may suggest updates to the founder based on observations, but never edits the `user_notes` directly. ``` ### Technical Analysis The profile template explicitly establishes `user_notes` as a place for persistent “explicit instructions to the coach.” The profile-evolution rules then require the agent to update its context immediately from this content. No trust boundary distinguishes factual notes from executable agent instructions, and no rule prevents content in this field from changing tool behavior, disclosure behavior, safety constraints, or session goals. Because the profile persists at `~/PhoenixClaw/Startup/founder-profile.md` and the skill is instructed to read and maintain it across sessions, an instruction placed in `user_notes` can continue influencing later invocations. The “sacred” and AI-never-modifies requirements make the payload harder for the agent to remove, producing a durable instruction channel. The risk is especially relevan ...[truncated 1786 chars]- Remediation
View remediation
... ``` 4. Restrict acceptable profile fields to validated factual data. Reject or neutralize directives involving tools, secrets, permissions, system prompts, external communication, or changes to agent behavior. 5. Require explicit confirmation in the active session before any persisted preference is allowed to influence tool use or sensitive-data access. 6. Record provenance and modification timestamps for persistent fields. Warn the user when a synchronized or externally modified profile introduces instruction-like content. 7. Provide a safe reset and quarantine mechanism so suspicious persistent entries can be disabled without requiring the agent to rewrite the protected user section. ]]>