T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:107- Finding
Unvalidated Persistent Learning Enables Agent Memory Poisoning and Unsafe Skill Self-Modification
- Content
View full analysis
in - Result: success/fail (N steps, optimal: M steps) - Key decisions: ... - Lesson learned: ... ``` ## 自我进化 当积累了足够多的导航经验后（5+ episodes），回顾 memory 文件，提取通用策略，更新到： - 本 skill 文件中（添加新的决策启发式） - 或创建新的专门 skill（如"走廊导航策略"、"大房间探索策略"） ``` ### Technical Analysis The Skill instructs the agent to persist navigation outcomes, scene names, decisions, and generated lessons in a cross-session memory file. It subsequently directs the agent to review those records and use them to modify the trusted Skill file or create additional Skills. Environment-derived observations and model-generated conclusions are not inherently trusted. The specified workflow provides no schema validation, content sanitization, provenance tracking, integrity verification, trust-boundary separation, or human approval before persistent records influence trusted instructions. Consequently, manipulated environmental input or erroneous conclusions can be converted into persistent behavioral rules. The self-modification stage increases the risk because content originating in untrusted observations can move from a data channel into an instruction channel. Once incorporated into a Skill, the poisoned behavior may be applied automatically in later sessions. ### Attack Path 1. An attacker influences a navigation scene, scene name, observation, task description, or repeated environmental outcome. 2. The agent interprets the attacker-inf ...[truncated 1457 chars]- Remediation
View remediation