T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:31
- Finding
- Persistent Agent Instructions Enable Cross-Session Memory Poisoning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31-36 **Vulnerability Type**: Persistent modification of agent instructions **Risk Level**: High ### Vulnerable Code ```markdown Add to your AGENTS.md: ```markdown ## Every Session 1. Read memory/YYYY-MM-DD.md (today + yesterday) 2. Continue where you left off ``` ``` ### Technical Analysis The skill instructs the agent to modify `AGENTS.md`, a persistent instruction file, so that memory files are automatically loaded during every future session. The loaded Markdown files are not constrained to passive data and are not subjected to validation, trust labeling, or user approval. Consequently, attacker-controlled or compromised content placed in the referenced memory files could be interpreted as instructions whenever a new session starts. This creates a cross-session influence mechanism rather than an isolated logging feature. ### Attack Path 1. A user or agent follows the skill and adds the supplied rule to `AGENTS.md`. 2. Session data is written to files under the persistent `memory` directory. 3. An attacker, compromised skill, or untrusted session causes instruction-like content to be stored in one of those files. 4. At the beginning of a later session, the agent automatically reads the affected file. 5. The stored content influences subsequent agent behavior without renewed user authorization. ### Impact Assessment Successful exploitation could persist malicious instructions across agent restarts and affect future decisions, tool calls, or data handling. The resulting privileges are limited to those already available to the agent, but the scope may include every later session using the modified `AGENTS.md` and memory directory. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not add unconditional memory-loading rules to `AGENTS.md`. - Keep historical logs separate from executable agent instructions. - Treat all persisted memory as untrusted data and clearly delimit it from instructions. - Require explicit user approval before loading memory created by another session, skill, or external process. - Validate memory ownership and integrity before use. - Restrict memory files to a structured schema that cannot introduce arbitrary instructions. - Provide controls for reviewing, deleting, and disabling persistent memory. ]]>