T02 · Agent Memory Poisoning
Warning
- Location
- scripts/memory-api.py:56
- Finding
- Unsanitized Persistent Memory Can Poison Future Agent Context## Vulnerability Details **File Location**: `scripts/memory-api.py:56-98`, `scripts/memory-api.py:124-125`, `scripts/memory-api.py:166-176`, `scripts/memory-api.py:337-363`, and `scripts/memory-retrieve.py:56-95` **Vulnerability Type**: Persistent agent memory poisoning through untrusted content storage and automatic context injection **Risk Level**: Medium ### Vulnerable Code ```python def store(self, content: str, memory_type: str, importance: Optional[float] = None, auto_append: bool = True) -> Dict: timestamp = datetime.now().isoformat() if importance is None: importance = self.scorer.score_memory(content, memory_type, datetime.now()) memory = Memory( content=content, type=memory_type, importance=importance, timestamp=timestamp, source="manual", metadata={} ) if auto_append: if memory_type == "context": self._append_to_session_state(content, memory_type) elif memory_type in ["preference", "lesson", "decision"]: self._append_to_memory_md(content, memory_type, importance) else: self._append_to_daily_log(content, memory_type, importance) ``` ```python # Automatic injection of retrieved memory if auto_inject and formatted_results: response["injected_context"] = self._format_context_for_injection(formatted_results) ``` ```python def _format_context_for_injection(self, memories: List[Dict]) -> str: if not memories: return "" lines = ["## 相关记忆"] for i, mem in enumerate(memories, 1): lines.append(f"{i}. [{mem['type']}] {mem['content']} (评分: {mem['score']})") return "\n".join(lines) ``` ```python def _append_to_session_state(self, content: str, memory_type: str): if not self.session_state.exists(): return with open(self.session_state, "a") as f: f.write(f"- {content}\n") def _append_to_memory_md(self, content: str, memory_type: str, importanc ...[truncated 4467 chars]
- Remediation
- ## Remediation Suggestions 1. Treat all externally derived memory content as untrusted data, regardless of memory type or importance score. 2. Require a successful security-validation step before persistence. Do not allow `store()` to bypass validation by default. 3. Add detection and quarantine for instruction-like content, including attempts to redefine roles, override prior instructions, request secret disclosure, or direct tool execution. 4. Record provenance, creator identity, trust level, validation status, and creation channel for every memory item. 5. Permit automatic context injection only for records from explicitly trusted sources. Require user confirmation before promoting untrusted content to long-term memory. 6. Serialize memory as structured data rather than interpolating raw content into Markdown. Escape delimiters and prevent stored content from creating new headings, list structures, or instruction blocks. 7. Wrap retrieved records in a clearly delimited data container and prepend an explicit policy stating that memory is reference data and cannot override system, developer, or current user instructions. 8. Keep untrusted memories separate from `SESSION-STATE.md` and other high-priority context sources. 9. Add expiration, review, revocation, and deletion controls so poisoned entries can be identified and removed. 10. Add regression tests using representative persistent prompt-injection payloads to verify that malicious records are rejected, quarantined, or rendered inert during retrieval.