T02 · Agent Memory Poisoning
Warning
- Location
- injector.py:519
- Finding
- Persistent Continuity State Can Poison Future Model Context## Vulnerability Details **File Location**: `store.py:183-221`, `store.py:226-273`, `injector.py:519-586`, `service.py:221-234` **Vulnerability Type**: Persistent agent memory poisoning **Risk Level**: Medium ### Vulnerable Code ```python # store.py:183-221 def upsert_soul_card( self, agent_id: str, role: str, persona: str, user_profile: str, preferences: Optional[dict[str, Any]] = None, constraints: Optional[dict[str, Any]] = None, ) -> bool: try: preferences_json = self._encode_obj( preferences, "preferences_encode_fallback", {"agent_id": agent_id}, ) constraints_json = self._encode_obj( constraints, "soul_constraints_encode_fallback", {"agent_id": agent_id}, ) with self._connect() as conn: conn.execute( """ INSERT INTO soul_card_v1 ( agent_id, role, persona, user_profile, preferences_json, constraints_json, updated_at, schema_version ) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(agent_id) DO UPDATE SET role = excluded.role, persona = excluded.persona, user_profile = excluded.user_profile, preferences_json = excluded.preferences_json, constraints_json = excluded.constraints_json, updated_at = excluded.updated_at, schema_version = excluded.schema_version; """, ( agent_id, role, persona, user_profile, preferences_json, constraints_json, utc_now_iso(), SCHEMA_VERSION, ...[truncated 5821 chars]
- Remediation
- ## Remediation Suggestions 1. Require authentication and per-agent authorization for every operation that creates or changes continuity state. 2. Record each field's source, owner, creation time, and trust level, and reject records lacking valid provenance. 3. Add integrity protection, such as keyed signatures, so unauthorized database changes are detected before injection. 4. Represent continuity values as explicitly untrusted quoted data rather than instruction-bearing text. 5. Add a model-facing policy stating that continuity data cannot override system, developer, safety, or current-user instructions. 6. Use strict schemas and field-specific length limits; reject unexpected keys and control-oriented structures. 7. Consider filtering common prompt-control patterns as defense in depth, while not relying on pattern matching as the primary security boundary. 8. Maintain an audit trail for state changes and support revocation or rollback of suspicious records. 9. Separate continuity state by tenant and agent identity to prevent cross-agent record access. 10. Add tests that store adversarial instructions in every injectable field and verify that the integration treats them only as untrusted data.