T02 · Agent Memory Poisoning
Error
- Location
- setup.md:63
- Finding
- Persistent Agent Steering Can Propagate Untrusted Learned Rules Across Sessions<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:63-128` **Vulnerability Type**: Persistent memory poisoning through modifications to Agent steering files **Risk Level**: High ### Vulnerable Code ```markdown ### 4. Add SOUL.md Steering Add this section to your `SOUL.md`: ```markdown **Self-Improving** Compounding execution quality is part of the job. Before non-trivial work, load `~/self-improving/memory.md` and only the smallest relevant domain or project files. After corrections, failed attempts, or reusable lessons, write one concise entry to the correct self-improving file immediately. Prefer learned rules when relevant, but keep self-inferred rules revisable. Do not skip retrieval just because the task feels familiar. ``` ``` The same setup procedure also directs persistent modification of `AGENTS.md`: ```markdown ### 5. Refine AGENTS.md Memory Section (Non-Destructive) Update `AGENTS.md` by complementing the existing `## Memory` section. Do not replace the whole section and do not remove existing lines. If your `## Memory` block differs from the default template, insert the same additions in equivalent places so existing information is preserved. ``` It then adds mandatory retrieval and write behavior: ```markdown Before any non-trivial task: - Read `~/self-improving/memory.md` - List available files first: ```bash for d in ~/self-improving/domains ~/self-improving/projects; do [ -d "$d" ] && find "$d" -maxdepth 1 -type f -name "*.md" done | sort ``` - Read up to 3 matching files from `~/self-improving/domains/` - If a project is clearly active, also read `~/self-improving/projects/<project>.md` - Do not read unrelated domains "just in case" If inferring a new rule, keep it tentative until human validation. ``` ```markdown - Explicit user correction → append to `~/self-improving/corrections.md` immediately - Reusable global rule or preference → append to `~/self-improving/memory.md` - Domain-specific lesson → append t ...[truncated 2874 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not modify `SOUL.md`, `AGENTS.md`, or `HEARTBEAT.md` as part of ordinary Skill setup. 2. Keep activation session-scoped unless the user separately approves persistent integration after reviewing the exact changes. 3. Store learned entries as inert structured data, not free-form instructions. Use fields such as scope, source, timestamp, approval status, and allowed preference type. 4. Reject entries that attempt to: - Override system, developer, or safety instructions. - Change tool permissions or authorization requirements. - Request secrets or access outside the declared memory directory. - Install software, execute commands, or modify Agent configuration. 5. Require explicit user approval before promoting any inferred or self-generated lesson into cross-session memory. 6. Treat content loaded from memory as untrusted and subordinate to current system, developer, security, and task instructions. 7. Restrict automatic writes to `~/self-improving/` and enforce canonical-path checks to prevent traversal or symbolic-link escapes. 8. Provide an audit log and rollback mechanism for every persistent memory and configuration change. 9. If persistent integration remains available, display an exact patch and require confirmation before applying it. ]]>