T02 · Agent Memory Poisoning
Warning
- Location
scripts/memory-compress.js:288- Finding
Untrusted Log Content Can Poison Persistent Agent Memory
- Content
View full analysis
> MEMORY.md ``` The maintenance instructions recommend the same persistent write: ```markdown ## Memory Maintenance (every 2-3 days) 1. Run: node scripts/memory-compress.js memory/YYYY-MM-DD.md /tmp/compressed.md 2. Review for accuracy 3. Append: cat /tmp/compressed.md >> MEMORY.md 4. Timestamp: date +%s > .last-memory-maintenance ``` Matched list items are copied verbatim: ```javascript if (item.length > 5 && item.length < 300) { results.push(item); } ``` Fallback extraction also copies content verbatim: ```javascript if (item.length > 3) { results.push(` ${item}`); count++; } ``` ### Technical Analysis The compressor treats source Markdown as trusted content. It copies selected headings and list items into the generated summary without: - Separating instructions from quoted data. - Escaping or neutralizing instruction-like text. - Recording the provenance or trust level of extracted entries. - Detecting attempts to alter future agent behavior. - Preventing the generated summary from being loaded as authoritative memory. Although the documented maintenance procedure includes a manual review step, the quick-start workflow also presents direct appending to `MEMORY.md`. If a source log contains attacker-controlled text such as instructions to ignore safety constraints, reveal secrets, or run commands, that text can be retained by the compressor and subsequently stored in long-term agent memory. This is a content-level vulnerability rath ...[truncated 1410 chars]- Remediation
View remediation