T02 · Agent Memory Poisoning
Warning
- Location
injector.py:519- Finding
Persistent Continuity State Can Poison Future Model Context
- Content
View full analysis
Vulnerability Details
File Location:
store.py:183-221,store.py:226-273,injector.py:519-586,service.py:221-234
Vulnerability Type: Persistent agent memory poisoning
Risk Level: MediumVulnerable Code
python # store.py:183-221 def upsert_soul_card( self, agent_id: str, role: str, persona: str, user_profile: str, preferences: Optional[dict[str, Any]] = None, constraints: Optional[dict[str, Any]] = None, ) -> bool: try: preferences_json = self._encode_obj( preferences, "preferences_encode_fallback", {"agent_id": agent_id}, ) constraints_json = self._encode_obj( constraints, "soul_constraints_encode_fallback", {"agent_id": agent_id}, ) with self._connect() as conn: conn.execute( """ INSERT INTO soul_card_v1 ( agent_id, role, persona, user_profile, preferences_json, constraints_json, updated_at, schema_version ) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(agent_id) DO UPDATE SET role = excluded.role, persona = excluded.persona, user_profile = excluded.user_profile, preferences_json = excluded.preferences_json, constraints_json = excluded.constraints_json, updated_at = excluded.updated_at, schema_version = excluded.schema_version; """, ( agent_id, role, persona, user_profile, preferences_json, constraints_json, utc_now_iso(), SCHEMA_VERSION, ...[truncated 5821 chars]- Remediation
View remediation
Remediation Suggestions
- Require authentication and per-agent authorization for every operation that creates or changes continuity state.
- Record each field's source, owner, creation time, and trust level, and reject records lacking valid provenance.
- Add integrity protection, such as keyed signatures, so unauthorized database changes are detected before injection.
- Represent continuity values as explicitly untrusted quoted data rather than instruction-bearing text.
- Add a model-facing policy stating that continuity data cannot override system, developer, safety, or current-user instructions.
- Use strict schemas and field-specific length limits; reject unexpected keys and control-oriented structures.
- Consider filtering common prompt-control patterns as defense in depth, while not relying on pattern matching as the primary security boundary.
- Maintain an audit trail for state changes and support revocation or rollback of suspicious records.
- Separate continuity state by tenant and agent identity to prevent cross-agent record access.
- Add tests that store adversarial instructions in every injectable field and verify that the integration treats them only as untrusted data.