T02 · Agent Memory Poisoning
Error
- Location
injection-engine.js:189- Finding
Persistent Stored-Memory Content Is Injected into Agent Prompts Without Trust-Boundary Controls
- Content
View full analysis
{ const content = memory.compressedContent || memory.content; const tags = memory.tags ? `[${memory.tags.slice(0, 3).join(', ')}]` : ''; const importance = this.importanceIcon(memory.importance); return `${importance} ${content} ${tags}`; }); return `\n📚 相关记忆:\n${lines.join('\n')}`; } /** * Detailed format */ formatDetailed(memories) { const lines = memories.map(memory => { const content = memory.originalContent || memory.content; const meta = [ `重要性：${memory.importance}`, `分类：${memory.category}`, `时间：${new Date(memory.timestamp).toLocaleDateString('zh-CN')}` ].join(', '); return `• ${content}\n (${meta})`; }); return `\n📚 相关记忆:\n${lines.join('\n\n')}`; } ``` Injection is enabled by default: ```json "injection": { "enabled": true, "maxMemories": 5, "minImportance": 50, "format": "concise" } ``` ### Technical Analysis The engine concatenates stored memory content directly into text intended for an agent prompt. It does not: - Mark memory content as untrusted data. - Escape or reject instruction-like content. - Separate data and instructions using a structured message boundary. - Record and enforce provenance or trust levels. - Require confirmation before reusing externally influenced memories. Consequently, a stored memory containing imperative text can be interpreted as an agent instruction when it is selected in a later session. Because memories are designed to persist and influence future conversations, this is a persistent indirect prompt-injection and memory-poisoning path. The high-importance selection logic ...[truncated 1337 chars]- Remediation
View remediation