T02 · Agent Memory Poisoning
Error
- Location
scripts/distill.py:265- Finding
Untrusted session content can poison persistent Agent memory
- Content
View full analysis
str: """Call the LLM to distill the transcript. Returns markdown or NO_DISTILL.""" prompt_template = PROMPT_FILE.read_text(encoding="utf-8") full_prompt = f"""{prompt_template} --- EXISTING DAILY LOG (do not duplicate) --- {existing_log if existing_log else "(empty — no existing log for this date)"} --- SESSION TRANSCRIPT --- {transcript} """ payload = { "model": "claude-opus-4-6", "messages": [ {"role": "user", "content": full_prompt} ], "max_tokens": 2048, "temperature": 0.1, } try: result = subprocess.run( [ "curl", "-s", "-X", "POST", "http://localhost:4000/v1/chat/completions", "-H", "Content-Type: application/json", "-H", "Authorization: Bearer sk-1234", "-d", json.dumps(payload), ], capture_output=True, text=True, timeout=120, ) response = json.loads(result.stdout) content = response["choices"][0]["message"]["content"] return content.strip() except Exception as e: print(f" ERROR: Distillation failed: {e}") return None ``` The resulting model output is persisted without validation: ```python def append_to_daily_log(date_str: str, session_uuid: str, distilled: str, source_file: str): """Append distilled content to the daily memory file.""" daily_file = MEMORY_DIR / f"{date_str}.md" section = f""" ## Session Distillation — {session_uuid[:8]} - **Distilled:** {datetime.now().strftime("%Y-%m-%d %H:%M CST")} - ** ...[truncated 2737 chars]- Remediation
View remediation