T02 · Agent Memory Poisoning
Error
- Location
index.js:176- Finding
Persistent prompt injection through automatically recalled memory
- Content
View full analysis
{ if (!event.prompt || event.prompt.length < 5) return; try { await memory.init(); const results = await memory.search(event.prompt, 3, 0.3); if (results.length === 0) return; const memoryContext = results .map(r => `- [${r.entry.category}] ${r.entry.text}`) .join('\n'); api.logger.info?.(`elite-ltm: injecting ${results.length} memories`); return { prependContext: `\nThe following memories may be relevant:\n${memoryContext}\n` }; ``` ### Technical Analysis The `memory_store` tool accepts arbitrary text and persists it without recording its provenance, assigning a trust level, filtering instruction-like content, or escaping structural delimiters. The automatic recall hook subsequently inserts matching memory text directly into the Agent's prompt context. The `` wrapper is not a security boundary. Stored content can contain instructions or delimiter-breaking text such as ``, allowing data presented as memory to be interpreted as Agent instructions. Because the content is persistent, the injection can affect later sessions rather than only the session in which it was stored ...[truncated 1072 chars]- Remediation
View remediation