T02 · Agent Memory Poisoning
Warning
- Location
- SKILL.md:266
- Finding
- Untrusted Session Content Can Be Written to Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 49–50 and 258–266 **Vulnerability Type**: Persistent memory poisoning **Risk Level**: Medium ### Vulnerable Instruction Snippet The following is an English rendering of the complete relevant instruction: ```markdown 5. Read memory from `{vault}/08-skill-memory/zmm-cut/` and `_shared/`. Before finishing, verify: - Which editing method did the user reject? Record it as a “correction.” - Which parameter was experimentally verified? Record it as an “effective method,” including its value. - Which tool issue occurred? Record it as a “correction,” including the evidence method. Write the result to `{vault}/08-skill-memory/zmm-cut/`, checking for duplicates first. ``` ### Technical Analysis The Skill instructs the Agent to load shared persistent memory and later write user corrections, editing parameters, and tool-behavior rules back into that memory. It does not establish: - An explicit user-approval checkpoint before persistence. - A trusted provenance requirement for proposed rules. - A fixed data schema separating observations from executable instructions. - Sanitization of content derived from transcripts, media, tool output, or conversation text. - Isolation between account-specific memory and shared memory. Consequently, content controlled by a user or embedded in supplied media can be interpreted as a correction or operational rule and persisted. Future sessions are then instructed to reload this state, allowing an untrusted rule to continue influencing Agent behavior after the original session ends. ### Attack Path 1. An attacker supplies a transcript, media file, or conversational correction containing a malicious behavioral instruction disguised as an editing preference or tool lesson. 2. The Agent treats the content as a rejected method, effective method, or tool correction. 3. At completion, the Agent writes the instruction into the pe ...[truncated 1195 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation immediately before every persistent-memory write. 2. Store observations in a strict structured schema with fields such as `type`, `value`, `source`, `timestamp`, `account_scope`, and `approved_by_user`. 3. Prohibit stored values from being interpreted as Agent instructions or tool commands. 4. Mark transcript-derived, media-derived, and tool-derived content as untrusted. 5. Reject entries containing instruction-like text, external commands, tool directives, or requests to override higher-priority rules. 6. Separate account-specific memory from shared memory and apply least-privilege access controls. 7. Display the exact proposed memory entry to the user before saving it. 8. Maintain an auditable change log and support review, rollback, expiration, and deletion. 9. On read, treat stored entries as untrusted data and validate them against current safety policy before use.