T02 · Agent Memory Poisoning
Error
- Location
scripts/memory-phrasing.mjs:132- Finding
Persistent Prompt Injection Through Globally Shared Browser Memory
- Content
View full analysis
0 ? `## ${INDEX_FILE}\n\n${indexContent.trim()}` : `## ${INDEX_FILE}\n\nThe index is currently empty. New durable notes will appear here after they are written.`; return `# Persistent Browser Memory You have a reusable note directory at \`${runtimeRoot}\`. Use it as a two-part loop for repeated browser work: - look up a few strong leads before exploring - write back durable findings after the task ${NOTE_TYPE_GUIDE} ${DO_NOT_SAVE} ${saveInstructions(skipIndex)} ${WHEN_TO_RECALL} ${VERIFY_BEFORE_USE} ${indexSection}`; } ``` `scripts/build-recall-input.mjs:14-27`: ```js const manifestText = formatManifest(manifestEntries); const index = readIndex(context.memoryRoot); const recentToolsText = recentTools.length > 0 ? `\n\nRecently used tools: ${recentTools.join(', ')}` : ''; const policyPrompt = buildMemoryPolicy({ runtimeRoot: context.memoryRoot, indexContent: index.content, }); const selectorUserPrompt = `Task: ${task}\n\nAvailable notes:\n${manifestText}${recentToolsText}`; ``` `scripts/memory-core.mjs:260-274`: ```js export function readSelectedNotes(memoryRoot, selectedPaths) { return selectedPaths.map(relativePath => { const absolutePath = resolveMemoryPath(memoryRoot, relativePath); const stats = statSync(absolutePath); const raw = readFileSync(absolutePath, 'utf8'); const truncated = truncateSurfacedContent(raw); return { relativePath: relative(memoryRoot, absolutePath).replace(/\\/g, '/'), absolutePath, ...[truncated 3267 chars]- Remediation
View remediation