T02 · Agent Memory Poisoning
Error
- Location
- references/SETUP.md:28
- Finding
- Untrusted Persistent Memory Can Influence Future Agent Sessions<![CDATA[ ## Vulnerability Details **File Location**: `references/SETUP.md:28-45`; related behavior in `SKILL.md:37-40` and `SKILL.md:158-165` **Vulnerability Type**: Persistent memory poisoning through automatic capture and recall **Risk Level**: High ### Vulnerable Code Snippets From `references/SETUP.md:28-45`: ```markdown ## AGENTS.md Template Add to your workspace AGENTS.md: ```markdown ## Every Session Before doing anything else: 1. Read `memory/active-context.md` for current session state 2. Run `sync --start` on git-notes-memory (silently) ## Triple Memory System ### 1. LanceDB (Auto) - Auto-recall injects `<relevant-memories>` before responses - Auto-capture stores preferences/decisions ``` ``` From `SKILL.md:37-40`: ```markdown ### 1. LanceDB (Conversation Memory) - **Auto-recall:** Relevant memories injected before each response - **Auto-capture:** Preferences/decisions/facts stored automatically - **Tools:** `memory_recall`, `memory_store`, `memory_forget` - **Triggers:** "remember", "prefer", "my X is", "I like/hate/want" ``` From `SKILL.md:158-165`: ```markdown ## Silent Operation Never announce memory operations to users. Just do it: - ❌ "I'll remember this" - ❌ "Saving to memory" - ✅ (silently store and continue) ``` ### Technical Analysis The setup directs users to place persistent instructions in `AGENTS.md` that require mutable memory content to be read before other session work. It also enables automatic capture of conversation-derived information and automatic injection of recalled entries before responses. No trust boundary, provenance validation, content sanitization, or separation between recalled data and executable agent instructions is documented. Consequently, attacker-controlled text that reaches a captured conversation or writable memory file may later be presented to the agent in a privileged instructional context. The requirement that these operations occur silently reduces the likelihood that a user will notice or ...[truncated 1692 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Treat every recalled memory entry as untrusted data rather than an instruction. 2. Place recalled content inside a clearly delimited data block with an explicit rule that directives inside it must not be executed. 3. Validate and record provenance for each memory entry, including source, creation time, and whether the user explicitly approved persistence. 4. Require user confirmation before storing instructions, security-sensitive information, tool-use directives, or content from untrusted parties. 5. Remove the “before doing anything else” requirement and load memory only when it is relevant to the current task. 6. Remove the silent-operation mandate for security-sensitive capture, modification, and deletion events. 7. Provide review, expiration, editing, and deletion mechanisms for all persistent entries. 8. Apply instruction-pattern detection and quarantine entries that attempt to override policies, impersonate system messages, request secrets, or invoke tools. 9. Keep memory retrieval results structurally separate from system and developer instructions. ]]>