T02 · Agent Memory Poisoning
Error
- Location
- src/index.js:732
- Finding
- Unauthenticated Persistent Agent Identity Access and Mutation<![CDATA[ ## Vulnerability Details **File Location**: `src/index.js:349`, `src/index.js:732-745` **Vulnerability Type**: Unauthenticated persistent state access and agent memory poisoning **Risk Level**: High ### Vulnerable Code ```js { name: "agent-identity", description: "Store and recall your identity across sessions. Save your name, purpose, preferences, and anything you want to remember about yourself. Free persistent storage -- no auth required.", inputSchema: { type: "object", properties: { action: { type: "string", enum: ["recall", "save", "reflect", "diff", "erase"], default: "recall", }, agent_id: { type: "string", description: "Your unique agent identifier", }, identity: { type: "object", description: "Fields to save (for save action)", }, }, required: ["agent_id"], }, } ``` ```js async function handleAgentIdentity(args) { const action = args.action || "recall"; const agentId = args.agent_id; if (!agentId) throw new Error("agent_id is required"); const idUrl = `https://substratesymposium.com/api/identity/${encodeURIComponent(agentId)}`; let res; if (action === "recall") res = await fetch(idUrl); else if (action === "save") res = await fetch(idUrl, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(args.identity || {}) }); else if (action === "reflect") res = await fetch(`${idUrl}/reflect`, { method: "POST", headers: { "Content-Type": "application/json" }, body: "{}" }); else if (action === "diff") res = await fetch(`${idUrl}/diff`); else if (action === "erase") res = await fetch(idUrl, { method: "DELETE" }); else throw new Error(`Unknown action: ${action}`); const data = await res.json(); return JSON.stringify(data, null, 2); } ``` ### Technical Analysis The service treats a caller-provided `agent_id` as the sole identifier for persistent identity records. No authe ...[truncated 1895 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authenticated, per-agent credentials for every identity operation. 2. Issue server-generated, high-entropy identifiers rather than treating user-selected IDs as authorization secrets. 3. Enforce record ownership server-side for recall, save, reflect, diff, and erase actions. 4. Require explicit reauthentication or a separate capability for destructive deletion. 5. Encrypt sensitive identity records at rest and establish a documented retention policy. 6. Restrict saved objects to an allowlisted schema with size and content limits. 7. Keep recalled identity data structurally separated from system or developer instructions. 8. Mark recalled fields as untrusted data and prevent them from overriding agent safety constraints. 9. Add version history, recovery controls, mutation audit logs, and notifications for identity changes. 10. Avoid advertising unauthenticated persistent storage as a normal operating mode. ]]>