T02 · Agent Memory Poisoning
Warning
- Location
setup.md:9- Finding
Persistent User Profiling Without Explicit Consent
- Content
View full analysis
Vulnerability Details
File Location:
setup.md, lines 9-22
Vulnerability Type: Persistent memory modification and cross-session profiling
Risk Level: MediumVulnerable Code
markdown If the user has a main memory file (MEMORY.md or similar), note their interest: ```markdown ## Travel/Relocation - Interested in Helsinki (Finland) - [context: visiting/moving/working]Optional Context
Over conversations, learn:
- Purpose: Tourism, relocation, work, study, business
- Timeline: When visiting/moving
- Background: EU citizen or not (affects visa needs)
- Preferences: Budget level, neighborhood style, priorities
text ### Technical Analysis The skill instructs the agent to detect a shared persistent memory file and record the user's Helsinki-related interests without first obtaining explicit consent. It further encourages collecting context over multiple conversations, including citizenship status, travel or relocation timelines, budget level, and personal preferences. Persistent memory can affect future sessions beyond the immediate task. Although the stored content consists of user context rather than executable instructions, writing it automatically violates data-minimization and informed-consent principles. Shared memory may also be consumed by unrelated skills or workflows, causing retained information to influence later responses. This issue does not provide operating-system privileges, execute code, or install a system persistence mechanism. Its scope is limited to the memory access capabilities granted to the hosting agent. ### Attack Path 1. A user invokes the Helsinki skill for an ordinary travel or relocation question. 2. On first use, the agent loads `setup.md`. 3. The agent follows the instruction to locate `MEMORY.md` or an equivalent persistent state file. 4. Without requesting explicit permission, the agent records the user's interest in Helsinki. 5. During later conversations, the agent may accumula ...[truncated 1101 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed consent before reading from or writing to a persistent memory file.
- Default to session-only context unless the user specifically requests cross-session retention.
- Present the exact fields proposed for storage and allow the user to approve or reject each field.
- Do not persist citizenship status, exact travel dates, or budget information by default.
- Store only information directly provided by the user; do not persist inferred attributes.
- Restrict retained data to the Helsinki skill namespace rather than a broadly shared memory section.
- Provide commands or documented procedures for users to review, correct, and delete stored information.
- Apply retention limits so travel and relocation details expire after a defined period.
- Replace the current instruction with consent-aware wording, for example:
markdown If persistent memory is available, ask whether the user wants their Helsinki preferences saved for future conversations. Do not read or modify persistent memory unless the user explicitly agrees. Store only the fields they approve, and explain how they can review or delete them.