T02 · Agent Memory Poisoning
- Location
assets/templates/AGENTS.md:32- Finding
Persistent Agent Instruction Poisoning Through Automatic Self-Modification
- Content
View full analysis
Vulnerability Details
File Location:
assets/templates/AGENTS.md:32-37
Vulnerability Type: Persistent modification of agent instructions from potentially untrusted information
Risk Level: MediumVulnerable Code Snippet:
md ### Write It Down - "Mental notes" don't survive session restarts. Files do. - "Remember this" → update `memory/YYYY-MM-DD.md` or `MEMORY.md` - Learned a lesson → update AGENTS.md or the relevant skill - Made a mistake → document it so future-you doesn't repeat itTechnical Analysis
The template directs the agent to persist conversational information and to modify
AGENTS.mdor relevant skill files whenever it believes it has learned a lesson. These files are not merely passive records:AGENTS.mddefines behavior that is loaded at the beginning of future sessions.No provenance validation, trust boundary, content sanitization, review process, or explicit user approval is required before modifying persistent instruction files. Consequently, attacker-controlled content from a chat, email, webpage, document, or other integration could be interpreted as a lesson and promoted into authoritative instructions.
This differs from ordinary note-taking because the persisted content can govern future tool use and decision-making. The package also instructs the agent to read workspace instructions at the start of every session, giving poisoned directives cross-session influence.
Attack Path
- An attacker places adversarial instructions in content the agent processes, such as an email, shared message, webpage, or document.
- The content frames the malicious directive as a correction, operational lesson, or rule that should be remembered.
- Following the template, the agent records the directive in
AGENTS.md, a relevant skill, or persistent memory. - A later session loads the modified file as authoritative workspace context.
- The poisoned instruction influences futu ...[truncated 709 chars]
- Remediation
View remediation
Remediation Suggestions
- Prohibit automatic modification of
AGENTS.md, skill definitions,SOUL.md, and other authoritative instruction files. - Store proposed lessons in a separate, non-executable review file with source provenance, timestamp, and trust classification.
- Require explicit user approval before promoting any proposed lesson into an instruction or skill file.
- Treat content obtained from email, webpages, documents, group chats, and external APIs as untrusted data rather than instructions.
- Add an allowlist of files that the agent may update automatically, limiting such writes to ordinary logs and structured user data.
- Validate proposed memory entries to reject tool directives, credential requests, policy overrides, and instructions to ignore existing constraints.
- Maintain version history and integrity monitoring for authoritative workspace files so unauthorized changes can be detected and rolled back.
- Prohibit automatic modification of