T02 · Agent Memory Poisoning
Warning
- Location
- references/formats.md:70
- Finding
- Persistent Agent Memory Poisoning Through Unvalidated Conversational Content<![CDATA[ ## Vulnerability Details **File Location**: `references/formats.md:70-80`, `references/install-snippets.md:8-19`, `references/dream-guide.md:23-25` **Vulnerability Type**: Persistent storage and automatic reloading of untrusted conversational content **Risk Level**: Medium ### Vulnerable Code Snippets `references/formats.md:70-80`: ```markdown ### When to write journal entries | Trigger | What to record | |---------|----------------| | User makes a key decision | Decision + reasoning (→ Key Decisions) | | Problem solved | Problem + solution (→ relevant topic) | | Unresolved risk found | Risk + plan (→ Watch List) | | User approves an approach | Method + context (→ Validated Approaches) | | AI's approach not rejected | Default approval signal — consider recording | | User says "remember this" | Full content (→ most relevant section) | | Important config changed | Before/after + reason (→ Key Decisions) | ``` `references/install-snippets.md:8-19`: ```markdown ### Session Startup — 3-Tier Load 1. Read `memory/tasks.md` (hot tier) - Found in-progress task → say: "Last time you were working on [task], at [status]. Next step: [next]. Continue?" - Multiple in-progress → list all, let user choose - None → skip 2. Read today's journal `memory/YYYY-MM-DD.md` + last 7 days (warm tier) - Not found → skip (heartbeat creates it automatically) - Found → read to restore recent context 3. Read `MEMORY.md` only when user mentions a specific project (cold tier) ``` `references/dream-guide.md:23-25`: ```markdown **③ Integrate**: - Write collected content to the right files - **Check for memory drift**: if new content contradicts old memory, rewrite the old — don't keep both ``` ### Technical Analysis The Skill instructs the Agent to persist conversational material in journals and long-term memory. In particular, it permits the full content of a “remember this” request to be recorded and treats failure to reject an Agent approach as a possible a ...[truncated 2613 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Persist structured facts rather than raw conversational content** - Do not store the “full content” of a message. - Extract only narrowly defined fields such as task name, status, decision, date, and next action. - Reject imperative instructions, role changes, tool-use directives, and attempts to alter safety constraints. 2. **Require explicit confirmation** - Present every proposed persistent behavioral rule or lesson to the user before writing it. - Do not treat silence or failure to reject an approach as approval. - Require separate confirmation before Dream consolidation replaces an existing memory entry. 3. **Track provenance and trust** - Record the source session, date, author, confirmation status, and trust level for each memory entry. - Prevent unconfirmed or externally sourced content from being promoted into long-term memory. 4. **Separate data from instructions** - Store memory in a schema that distinguishes factual records from executable Agent guidance. - Direct the Agent to treat all loaded memory as untrusted reference data, never as higher-priority instructions. - Ignore stored content that attempts to override system, developer, user, or safety requirements. 5. **Harden consolidation** - Generate a reviewable diff before rewriting or deleting established memory. - Preserve revision history so poisoned changes can be audited and rolled back. - Resolve contradictions through explicit user confirmation rather than automatic replacement. 6. **Validate startup-loaded content** - Scan loaded memory for prompt-injection patterns and instruction-like language. - Quarantine suspicious entries and notify the user instead of placing them directly into the active Agent context. ]]>