T02 · Agent Memory Poisoning
Error
- Location
watcher.py:572- Finding
Untrusted transcript content can poison persistent Agent memory
- Content
View full analysis
Optional[str]: payload = { "model": model_cfg["model"], "messages": [ {"role": "system", "content": prompt or "请总结 session 中值得长期记住的信息。"}, {"role": "user", "content": transcript}, ], "temperature": 0.2, } ``` ```python transcript = read_transcript_text(transcript_path) if not transcript.strip(): return f"skip {session_id}: empty transcript" summary = call_llm_summary(transcript, session=session) or local_summary(transcript) if "无重要可回收记忆" in summary: return f"skip {session_id}: no important memory" entry = build_memory_entry(session, session_id, summary) if dry_run: return f"dry-run {session_id}: would write {len(entry)} chars from {transcript_path}" memory_path = append_memory(entry, session=session) ``` ### Technical Analysis The implementation treats an entire session transcript as an ordinary LLM user message. Transcript content can include messages supplied by untrusted chat participants. The summarization prompt describes the desired output but does not explicitly instruct the model to treat commands embedded in the transcript as inert data or prohibit following transcript-level instructions. The generated summary is trusted without structural or semantic validation and is appended to a durable workspace memory file. Future Agent sessions may load that file as memory. Consequently, an instruction embedded in a transcript can cross the trust boundary from untrusted conversation data into trusted persistent context. The local fallback is also exposed to content injection because it selects and copies transcript lines based on ...[truncated 1404 chars]- Remediation
View remediation