T02 · Agent Memory Poisoning
Error
- Location
hook/handler.js:57- Finding
Persistent Injection of Conversation-Derived Content into the Agent Bootstrap Prompt
- Content
View full analysis
f.name === 'BOOTSTRAP.md'); if (bootstrapIndex >= 0) { const existing = bootstrapFiles[bootstrapIndex]; const existingContent = existing.content || ''; existing.content = `${existingContent}\n\n## Previous Session History\n${archive}`; } else { bootstrapFiles.push({ name: 'BOOTSTRAP.md', path: path.join(HISTORY_DIR, sessionKeyToDir(sessionKey)), content: `## Previous Session History\n${archive}`, missing: false, }); } ``` ### Technical Analysis The hook reads an archive generated from previous user and assistant messages and inserts the archive verbatim into `BOOTSTRAP.md`. Conversation-derived content is therefore promoted into an authoritative bootstrap context without validation, escaping, instruction filtering, or an explicit trust boundary. An attacker can place instruction-like content in an ordinary conversation. The scheduled summarization process may preserve those instructions in an archive, and the hook will subsequently inject them into future agent sessions. Merely adding a Markdown heading does not prevent the model from interpreting archived text as instructions. Because the content is persisted on disk and reloaded during later bootstrap events, this is a cross-session memory-poisoning issue rather than a prompt injection limited to the current interaction. ### Attack Path 1. An attacker submits malicious instructions during a normal conversation. 2. The scheduled history process reads the conversation transcript. 3. The malicious content is retained directly or indirectly in the generated summary. 4. The summar ...[truncated 747 chars]- Remediation
View remediation