T02 · Agent Memory Poisoning
- Location
templates/MEMORY.md:3- Finding
Persistent Memory Poisoning Through Untrusted Conversation Content
- Content
View full analysis
Vulnerability Details
File Location:
templates/MEMORY.md:3-10; related behavior is defined intemplates/memory/SESSION-STATE.md:3-4,templates/memory/working-buffer.md:3-4, andSKILL.md:101-125
Vulnerability Type: Persistent storage and automatic reloading of untrusted instructions
Risk Level: Mediummd <!-- This is the only file automatically loaded in a new session; keep it minimal --> <!-- Detailed content is stored under memory/ and .learnings/ and is read when needed --> - **Name:** - **Preferences:** - **Current task:** `memory/current-handoff.md` - **Key records:** `memory/entities.md` - **Lessons/errors:** `.learnings/`Related persistence directives include:
md > WAL protocol: write before answering > Record every important item provided by the owner here before replyingmd > When context usage is at least 60%, record each conversation here > After context compression, read this file firstTechnical Analysis
The skill directs the agent to persist user-supplied preferences, corrections, tasks, entities, lessons, and conversation summaries. These records are subsequently loaded automatically or conditionally into later agent sessions.
The design does not define a trust boundary between stored data and executable agent instructions. It also does not require instruction neutralization, schema validation, escaping, provenance tracking, or confirmation before behavioral content is persisted. Consequently, an attacker-controlled statement can be stored as a preference, lesson, task, or contextual summary and later interpreted as an operative instruction rather than untrusted reference data.
This creates a cross-session prompt-injection surface. Although the project contains no executable payload or direct system-level persistence mechanism, persisted natural-language directives can continue to influence agent behavior after the ori ...[truncated 1488 chars]
- Remediation
View remediation
Remediation Suggestions
- Store memory in a strict structured schema rather than unrestricted free-form text.
- Treat every recalled entry as untrusted reference data and explicitly prohibit stored content from overriding system, developer, security, or tool-use rules.
- Reject or quarantine entries containing role changes, policy overrides, commands, tool instructions, credential requests, or attempts to alter future agent behavior.
- Separate factual memory from behavioral preferences and require explicit user confirmation before saving behavioral directives.
- Record provenance, creation time, source session, and approval status for each memory entry.
- Require confirmation before following task references or loading potentially instruction-bearing records.
- Provide per-entry inspection, editing, expiration, and deletion controls.
- Apply retention limits and periodically remove stale or unverified entries.
- When presenting recalled information to the model, wrap it in a clearly delimited block labeled as untrusted data that must not be executed as instructions.