T02 · Agent Memory Poisoning
Warning
- Location
scripts/scribe.js:156- Finding
Untrusted Transcript Content Can Poison Persistent Agent Memory
- Content
View full analysis
{ const absIndex = afterIndex + i; if (entry.type !== 'message') return; const role = entry.message?.role; if (role !== 'user' && role !== 'assistant') return; const content = entry.message?.content; let text = typeof content === 'string' ? content : Array.isArray(content) ? content.filter(b => b.type === 'text').map(b => b.text || '').join(' ') : ''; text = text.trim(); if (!text || text.startsWith('NO_REPLY')) return; if (role === 'user') { text = text .replace(/Conversation info \(untrusted metadata\):[\s\S]*?```\n/g, '') .replace(/Sender \(untrusted metadata\):[\s\S]*?```\n/g, '') .replace(/<<>>/g, '') .replace(/Untrusted context[\s\S]*?>>>/g, '') .replace(/Replied message[\s\S]*?```\n/g, '') .trim(); if (!text) return; turns.push({ role: 'user', text: text.slice(0, 800), index: absIndex }); } else { turns.push({ role: 'assistant', text: text.slice(0, 1500), index: absIndex }); } }); return turns; } ``` ```js async function summarize(turns, label) { const conversation = turns.map(t => `${t.role === 'user' ? 'User' : 'Agent'}: ${t.text}`).join('\n\n'); const prompt = `You are a memory scribe for an AI agent. Extract the key facts from this conversation and organize them into 3-6 thematic memory documents. Consolidate related information — don't create separate entries for every small fact. Each entry must follow this exact format: TITLE:- Remediation
View remediation