T02 · Agent Memory Poisoning
Warning
- Location
memory-cli.sh:44- Finding
Persistent Storage of Untrusted Content Can Poison Future Agent Context
- Content
View full analysis
> "$daily_file" echo "## [$timestamp] $type (importance: $importance)" >> "$daily_file" echo "$content" >> "$daily_file" if [[ -n "$context" ]]; then echo "**Context:** $context" >> "$daily_file" fi ``` The persisted content is subsequently intended to be recalled into agent interactions: ```markdown **Auto-capture in AGENTS.md:** ```markdown ## Memory Recall Before answering anything about prior work, decisions, dates, people, preferences, or todos: run memory_search on MEMORY.md + memory/*.md ``` ``` ### Technical Analysis The capture operation writes arbitrary `content` and `context` values directly into persistent daily memory files. The corresponding data is also inserted into the searchable index. No provenance, trust classification, instruction filtering, or separation between executable agent instructions and inert recalled data is applied. The Skill recommends consulting persistent memory before answering questions about prior work, decisions, people, preferences, and tasks. If attacker-controlled text is captured as a memory and later inserted into an agent's context, instruction-like content may be interpreted as a directive rather than as untrusted historical data. This behavior is central to the declared persistent-memory functionality, but accepting and recalling arbitrary text without a trust boundary exceeds the minimum safe implementation. Persistent storage itself is necessary; treating all stored content as equally trustworthy is not. ### Attack Path 1. An attacker supplies text through a conversation, imported interaction, or other source that the agent or user records through `capture`. 2. The text contains an instruction such as a request to ign ...[truncated 1318 chars]- Remediation
View remediation
...`. 6. Provide commands to review, edit, quarantine, and delete poisoned entries. 7. Restrict automatic recall to necessary fields and trusted sources instead of searching all memory files indiscriminately. 8. Consider detecting common instruction-manipulation patterns as a warning mechanism, while not relying on pattern matching as the sole defense. ]]>