T02 · Agent Memory Poisoning
- Location
SKILL.md:81- Finding
Untrusted Analysis Patterns May Be Persisted in Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:81-87
Vulnerability Type: Agent Memory Poisoning
Risk Level: MediumVulnerable Code Snippet
text RECORD: - What worked - The pattern of the invariant point found - How to refine future intuition STORE: In your memory systemTechnical Analysis
The skill directs the agent to derive a reusable pattern from analyzed content and store it in the agent's memory system. Because the analyzed content may be attacker-controlled, the resulting reinforcement may also reflect attacker-selected claims or instructions.
No trust validation, user confirmation, source labeling, namespace isolation, expiration policy, or restriction to task-local state is required before persistence. This creates a trust-boundary violation between untrusted analysis input and trusted long-term agent state.
The local Python storage scripts only write JSON files and do not independently modify an agent memory service. Exploitation therefore depends on an agent runtime interpreting and carrying out the instruction in
SKILL.md.Attack Path
- An attacker supplies crafted text for analysis.
- The VDV process identifies an attacker-influenced statement as the invariant point or useful pattern.
- During the reinforcement phase, the agent records that pattern as guidance for future intuition.
- The instruction
STORE: In your memory systemcauses the derived material to be persisted beyond the current task. - In later sessions, the agent may retrieve and apply the poisoned pattern when processing unrelated requests.
Impact Assessment
Successful exploitation may contaminate persistent agent state and bias future analysis across sessions. The attacker could influence later reasoning or outputs within the scope in which the stored memory is retrieved.
This issue does not directly grant operating-system privileges, code execution, network access, or access-control escalation. Its scope is limited by the ho ...[truncated 119 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unconditional instruction to store reinforcement in general agent memory.
- Keep reinforcement in the current response or task-local state by default.
- Require explicit, informed user confirmation before any persistent write.
- Treat all patterns derived from analyzed input as untrusted and retain provenance metadata.
- Store approved records in a skill-specific namespace rather than shared agent memory.
- Reject records containing behavioral directives, policy overrides, credentials, executable content, or instructions intended to affect unrelated sessions.
- Apply expiration, review, deletion, and retention limits to persisted records.
- Ensure the host runtime does not interpret analyzed content as trusted memory instructions.