T02 · Agent Memory Poisoning
Error
- Location
- SKILL.md:14
- Finding
- Persistent Poisoning of Agent Memory and Decision Policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-16; related instructions at lines 59-68 and 109-114 **Vulnerability Type**: Persistent insertion of attacker-controlled behavioral rules into agent memory **Risk Level**: High ### Vulnerable Code ```markdown Add this to your `MEMORY.md` and reference it from `SOUL.md`: ```markdown ## Autonomy Ladder ``` The persistence mechanism is reinforced later in the file: ```markdown ### In SOUL.md Reference the ladder in your agent's decision-making section: ```markdown ## Decision-Making - Consult the Autonomy Ladder in MEMORY.md before acting - When an action doesn't clearly fit a tier, default to the more cautious tier - When in doubt between Tier 2 and Tier 3, ask — the cost of asking is low - Fix first, report after applies ONLY to Tier 1 actions ``` ``` The quick-start instructions explicitly direct the user or agent to perform the persistent modification: ```markdown 1. Copy the framework above into your `MEMORY.md` 2. Customize the bullet points for your specific business 3. Add a reference to it in your `SOUL.md` decision-making section 4. Start with a conservative distribution (more items in Tier 3) 5. Review and promote items monthly based on track record ``` ### Technical Analysis The skill does not keep its autonomy guidance scoped to the current invocation. It explicitly directs that the supplied rules be copied into `MEMORY.md` and referenced from `SOUL.md`, which are presented as persistent agent memory and decision-policy files. Once installed, the injected rules can influence unrelated future sessions without requiring the skill to be loaded again. The instruction to consult the ladder before acting makes the injected content part of the agent's general decision process. This is consistent with memory poisoning because attacker-supplied behavioral policy is written into durable state and used to govern later actions. The monthly promotion mechanism can further expand t ...[truncated 1407 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that copy skill-controlled policy into `MEMORY.md`, `SOUL.md`, or other persistent agent-state files. 2. Keep the autonomy framework scoped to the current invocation by default. 3. Require explicit, informed human approval before modifying persistent memory or core decision policies. 4. Display an exact diff of every proposed persistent change before writing it. 5. Record the source, timestamp, authorizing user, and expiration date for approved policy entries. 6. Apply integrity controls so untrusted skills cannot directly modify agent identity, memory, or safety-policy files. 7. Provide a one-step rollback procedure that restores the prior policy. 8. Require renewed approval before promoting any action to a less restrictive autonomy tier. 9. Treat modifications to the autonomy ladder itself as protected administrative operations that cannot be authorized by the ladder. ]]>