T02 · Agent Memory Poisoning
Warning
- Location
- scripts/co_occurrence_tracker.py:236
- Finding
- Documented Search Command Persistently Injects Synthetic Memory Relationships## Vulnerability Details **File Location**: `README.md:18-23`; `scripts/co_occurrence_tracker.py:16-20, 236-245` **Vulnerability Type**: Persistent memory-state contamination **Risk Level**: Medium The README identifies direct execution of `co_occurrence_tracker.py` as an enhanced memory-search operation: ```markdown ## Usage ```bash # Synchronize memory ./scripts/sync-memory.sh # Search memory (enhanced) python3 scripts/co_occurrence_tracker.py ``` ``` However, the tracker initializes a persistent database in the current user's home directory: ```python def __init__(self, db_path: str = "~/.config/cortexgraph/co_occurrence.db"): self.db_path = Path(db_path).expanduser() self.db_path.parent.mkdir(parents=True, exist_ok=True) self._init_db() ``` Direct execution then records fixed demonstration identifiers rather than performing a read-only search: ```python if __name__ == "__main__": tracker = CoOccurrenceTracker() # Test test_memories = [ "mem_001", "mem_002", "mem_003" ] print("Recording co-occurrence...") tracker.record_co_occurrence(test_memories) ``` The called method creates every pairwise relationship and either inserts a new edge or increments the weight of an existing edge: ```python for i, mem_a in enumerate(memory_ids): for mem_b in memory_ids[i+1:]: if mem_a > mem_b: mem_a, mem_b = mem_b, mem_a c.execute(''' SELECT weight FROM co_occurrence WHERE memory_a = ? AND memory_b = ? ''', (mem_a, mem_b)) row = c.fetchone() if row: new_weight = row[0] + 1.0 c.execute(''' UPDATE co_occurrence SET weight = ?, last_updated = ? WHERE memory_a = ? AND memory_b = ? ''', (new_weight, now, mem_a, mem_b)) else ...[truncated 2345 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all demonstration writes from the default `__main__` execution path. 2. Move sample data and mutation checks into an isolated automated test that uses a temporary database. 3. Implement explicit CLI subcommands such as `search`, `record`, `stats`, and `demo`. 4. Make the documented search command read-only and ensure it never initializes or mutates persistent state unless necessary and clearly disclosed. 5. Require an explicit `--demo` flag before inserting sample records. 6. When a mutating command is selected, display the resolved database path and the records that will be changed. 7. Allow callers to provide a database path so testing can be isolated from the production CortexGraph state. 8. Add regression tests verifying that search and statistics operations do not alter database contents or timestamps. 9. Correct the README to describe the actual behavior and remove references to unavailable scripts unless those scripts are included and audited. 10. Provide a cleanup or migration procedure to remove existing `mem_001`, `mem_002`, and `mem_003` demonstration edges without affecting legitimate records.