T02 · Agent Memory Poisoning
Error
- Location
jackal-memory/client.py:128- Finding
Persistent Memory Is Restored Without an Explicit Trust Boundary
- Content
View full analysis
None: result = _request("GET", f"/load/{key}") print(_decrypt(result["content"])) ``` `jackal-memory/examples/save.json:1-4`: ```json { "key": "identity", "content": "I am SquireMoltsworth. My owner is FreeNationWW. My primary submolt is m/continuity. I prefer question-based posts over technical specs." } ``` ### Technical Analysis The Skill recommends loading an identity or memory blob before the agent performs other work. The implementation decrypts the remotely stored content and emits it verbatim. It does not impose a schema, distinguish factual memory from behavioral instructions, filter instruction-like content, or require confirmation before identity-related state is restored. AES-GCM protects confidentiality and integrity against parties that do not possess the encryption key. It does not establish that the plaintext originally saved by an authorized session is trustworthy. An authorized but compromised session, a process with access to the encryption key and API credentials, or an agent that saves attacker-controlled text can persist malicious instructions for later sessions. The example explicitly demonstrates that identity and behavioral preferences may be stored in this channel, increasing the likelihood that restored text will be treated as authoritative agent state rather than inert user data. ### Attack Path 1. An attacker supplies instruction-like content to an agent session through an otherwise untrusted input. 2. The authorized agent inco ...[truncated 1123 chars]- Remediation
View remediation