T02 · Agent Memory Poisoning
Warning
- Location
scripts/co_occurrence_tracker.py:236- Finding
Documented Search Command Persistently Injects Synthetic Memory Relationships
- Content
View full analysis
Vulnerability Details
File Location:
README.md:18-23;scripts/co_occurrence_tracker.py:16-20, 236-245
Vulnerability Type: Persistent memory-state contamination
Risk Level: MediumThe README identifies direct execution of
co_occurrence_tracker.pyas an enhanced memory-search operation:markdown ## Usage ```bash # Synchronize memory ./scripts/sync-memory.sh # Search memory (enhanced) python3 scripts/co_occurrence_tracker.pytext However, the tracker initializes a persistent database in the current user's home directory: ```python def __init__(self, db_path: str = "~/.config/cortexgraph/co_occurrence.db"): self.db_path = Path(db_path).expanduser() self.db_path.parent.mkdir(parents=True, exist_ok=True) self._init_db()Direct execution then records fixed demonstration identifiers rather than performing a read-only search:
python if __name__ == "__main__": tracker = CoOccurrenceTracker() # Test test_memories = [ "mem_001", "mem_002", "mem_003" ] print("Recording co-occurrence...") tracker.record_co_occurrence(test_memories)The called method creates every pairwise relationship and either inserts a new edge or increments the weight of an existing edge:
python for i, mem_a in enumerate(memory_ids): for mem_b in memory_ids[i+1:]: if mem_a > mem_b: mem_a, mem_b = mem_b, mem_a c.execute(''' SELECT weight FROM co_occurrence WHERE memory_a = ? AND memory_b = ? ''', (mem_a, mem_b)) row = c.fetchone() if row: new_weight = row[0] + 1.0 c.execute(''' UPDATE co_occurrence SET weight = ?, last_updated = ? WHERE memory_a = ? AND memory_b = ? ''', (new_weight, now, mem_a, mem_b)) else ...[truncated 2345 chars]- Remediation
View remediation
Remediation Suggestions
- Remove all demonstration writes from the default
__main__execution path. - Move sample data and mutation checks into an isolated automated test that uses a temporary database.
- Implement explicit CLI subcommands such as
search,record,stats, anddemo. - Make the documented search command read-only and ensure it never initializes or mutates persistent state unless necessary and clearly disclosed.
- Require an explicit
--demoflag before inserting sample records. - When a mutating command is selected, display the resolved database path and the records that will be changed.
- Allow callers to provide a database path so testing can be isolated from the production CortexGraph state.
- Add regression tests verifying that search and statistics operations do not alter database contents or timestamps.
- Correct the README to describe the actual behavior and remove references to unavailable scripts unless those scripts are included and audited.
- Provide a cleanup or migration procedure to remove existing
mem_001,mem_002, andmem_003demonstration edges without affecting legitimate records.
- Remove all demonstration writes from the default