T02 · Agent Memory Poisoning
Error
- Location
scripts/conversation-summarise.js:176- Finding
Untrusted Conversation Content Can Poison Persistent Agent Memory
- Content
View full analysis
150000) { prompt = prompt.slice(0, 150000) + '\n\n[...truncated for length]'; } const summary = await callLLM(prompt, SUMMARY_SYSTEM_PROMPT); const titleMatch = rawContent.match(/^# .+ — (.+)$/m); const topicName = titleMatch ? titleMatch[1] : path.basename(rawFile, '.md'); const output = `# ${topicName} — Summary\n\n*Last updated: ${new Date().toISOString()}*\n\n${summary}\n`; fs.writeFileSync(summaryFile, output); ``` The generated content is subsequently treated as agent context: ```markdown When receiving a message from a group/topic, load context before responding: 1. Check `archives///summaries/topic-.md` for topic context 2. For cross-topic awareness, skim `DIGEST.md` 3. If summary seems stale, re-run archive + summarise for that group ``` The architecture also directs the agent to promote summary content into core memory: ```markdown 1. Review topic summaries for significant new information 2. Integrate important decisions, contacts, or facts into MEMORY.md 3. The next `memory-bootstrap.js` run picks them up as new meta entries This creates a natural flow: conver ...[truncated 2547 chars]- Remediation
View remediation