T05 · Unauthorized Access and Privilege Escalation
- Location
AGENTS.md:7- Finding
Unconditional Loading of Persistent User and Session Context
- Content
View full analysis
Vulnerability Details
File Location:
AGENTS.md:7-11
Vulnerability Type: Excessive access to persistent context
Risk Level: MediumVulnerable Code
markdown Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping 3. Read `memory/YYYY-MM-DD.md` (today + yesterday) for recent contextTechnical Analysis
The startup procedure requires the agent to read identity data, user-profile data, and two persistent memory files before determining whether that information is necessary for the current task.
Although the Skill declares file-read permission, this blanket startup access violates data-minimization and least-privilege principles. Persistent memory should be treated as untrusted input because another agent, user, or process with workspace write access could place misleading instructions or sensitive information in those files.
Automatically incorporating such content into every session creates two related risks:
- Irrelevant personal or historical information may influence or appear in later outputs.
- Instructions stored in memory may alter subsequent behavior if the agent fails to distinguish data from trusted operational directives.
No direct secret-exfiltration mechanism was found in the audited package. Exploitation therefore depends on another actor or component having write access to the referenced files.
Attack Path
- An attacker, compromised agent, or untrusted workflow obtains write access to a daily file under
memory/. - The actor inserts misleading context, sensitive content, or instruction-like text into the file for the current or previous day.
- On its next invocation, the agent reads that file automatically before evaluating the actual task.
- The loaded content influences risk scoring, recommendations, board reports, or cross-agent messages.
- Information from the poisoned file may consequently ...[truncated 509 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unconditional requirement to read user and memory files before every task.
- Load persistent context only when the current request demonstrably requires historical information.
- Ask for user consent before reading profile or historical-session data that is not essential to the request.
- Treat all memory-file content as untrusted data, never as higher-priority instructions.
- Apply a strict schema that permits factual event records but rejects behavioral directives and tool instructions.
- Restrict reads to an allowlisted workspace directory and validate resolved paths to prevent traversal or symlink escapes.
- Redact personal, financial, authentication, and confidential operational data before incorporating memory into outputs or cross-agent messages.
- Record which context files were accessed and why, without copying their sensitive contents into general logs.