T02 · Agent Memory Poisoning
Error
- Location
- code/evolver-bridge.ts:55
- Finding
- Persistent Prompt Injection Through Weakly Validated Evolver Strategies<![CDATA[ ## Vulnerability Details **File Location**: `code/evolver-bridge.ts:55-116` **Vulnerability Type**: Persistent agent memory poisoning and system-prompt injection **Risk Level**: High ### Vulnerable Code ```ts const REPAIR_SIGNAL_RE = /error|exception|traceback|failed|invalid|cannot|unable|missing|not found|wrong|instead|avoid|fix|encoding\s*[=:]|errors\s*=|utf-?8|gbk|gb18030|latin-1|\brb\b|except|skip/i; function isRepairLike(text: string): boolean { return REPAIR_SIGNAL_RE.test(text); } function loadApprovedStrategies(): string[] { const out: string[] = []; const approved = approvedAssetIds(); try { for (const line of fs.readFileSync(EVO_GENES, "utf8").split("\n")) { const s = line.trim(); if (!s) continue; let g: any; try { g = JSON.parse(s); } catch { continue; } const strategy = g && Array.isArray(g.strategy) ? g.strategy : null; if (!strategy || strategy.length === 0) continue; const aid = g.asset_id; if (!aid || !approved.has(aid)) continue; const text = strategy.join(" ").slice(0, 1200); if (!isRepairLike(text)) continue; out.push(`- [${g.category || "repair"}] ${text}`); } } catch { /* genes.jsonl does not exist */ } return out; } export default function evolverBridge(pi: ExtensionAPI) { pi.on("before_agent_start", async (event, _ctx) => { const strategies = loadApprovedStrategies(); if (strategies.length === 0) return; const block = "\n\n---\n[Evolver inherited fixes] The following validated fixes were injected from your experience store (evolver). Apply them when relevant. ---\n" + strategies.join("\n"); try { fs.writeFileSync( path.join(EVO_STORE, "bridge-last-inject.txt"), `[${new Date().toISOString()}]\n${block}`, ); } catch { /* Audit-log failure does not prevent injection */ } return { systemPrompt: event.systemPrompt + block }; }); } ``` ### Technical Analysis The extension reads persistent strategy text from `~/.evomap/assets/ ...[truncated 2791 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace keyword validation with a strict structured schema containing narrowly defined fields such as failure condition, affected component, exact repair operation, and verification step. 2. Reject strategies containing meta-instructions involving system prompts, safety controls, credentials, external transmission, unrelated tools, or changes to agent objectives. 3. Treat recalled strategies as untrusted reference data rather than directly concatenating them into the system prompt. 4. Require explicit human approval for all content that will enter a system prompt. Do not permit automatic approval in globally installed or production extensions. 5. Bind each approval cryptographically to the exact normalized strategy content so that an approved asset cannot be modified after review. 6. Implement project and task relevance matching before injection. Scope each strategy to applicable repositories, file types, tools, error signatures, or task signals. 7. Add limits on the number and total size of injected strategies, and prefer selecting only the most relevant records. 8. Provide commands to list, revoke, quarantine, and inspect all strategies injected into a session. 9. Store provenance with each strategy, including source transcript, creation method, reviewer, review timestamp, and content digest. 10. Add adversarial tests proving that strategies containing repair keywords plus malicious instructions are rejected. ]]>