T02 · Agent Memory Poisoning
Error
- Location
src/deduplication.py:81- Finding
Verified memories can be silently replaced through similarity-based deduplication
- Content
View full analysis
best_score: best_score = similarity best_match = { "id": m.id, "content": m.content, "similarity": similarity, "verified": m.verified } ``` ```python # src/deduplication.py:154-164 else: # Highly similar, but not identical return { "should_store": True, "reason": f"Similar but contains new content ({dup_check['best_match']['similarity']:.1%})", "existing_memory": dup_check["best_match"], "action": "update" } ``` The corresponding source code uses a localized reason string, but the control flow and returned values shown above are unchanged. ```python # src/cli.py:68-69 if should['action'] == 'update' and should.get('existing_memory'): skill.db.delete(should['existing_memory']['id']) ``` The same destructive update behavior is repeated in the non-JSON CLI path: ```python # src/cli.py:279-280 if should['action'] == 'update' and should.get('existing_memory'): skill.db.delete(should['existing_memory']['id']) ``` ### Technical Analysis The deduplication manager compares new content against existing verified memories using a Jaccard word-set similarity calculation. If the best similarity score reaches the configured threshold of `0.8`, the new content is treated as an update rather than a separate memory. Th ...[truncated 2172 chars]- Remediation
View remediation