T02 · Agent Memory Poisoning
Warning
- Location
- memory_manager.py:40
- Finding
- Persistent Agent Memory Poisoning Through Unsanitized Content## Vulnerability Details **File Location**: `memory_manager.py:40-49` and `memory_manager.py:61-70` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium ### Vulnerable Code ```python timestamp = datetime.now().strftime("%H:%M:%S") entry = f"\n## [{timestamp}]\n\n{content}\n" if metadata: entry += f"\n_Meta: {json.dumps(metadata, ensure_ascii=False)}_\n" with open(daily_file, "a", encoding="utf-8") as f: f.write(entry) return str(daily_file) ``` ```python timestamp = datetime.now().strftime("%Y-%m-%d %H:%M") if not self.memory_file.exists(): with open(self.memory_file, "w", encoding="utf-8") as f: f.write("# MEMORY.md - Long-term Memory Archive\n\n") with open(self.memory_file, "a", encoding="utf-8") as f: f.write(f"\n## [{timestamp}] {category}\n\n") f.write(f"{key_insights}\n") ``` ### Technical Analysis The `save_conversation()` method writes the caller-controlled `content` value verbatim to a daily memory file. Similarly, `update_longterm()` writes `key_insights` and the associated category directly into the long-term `MEMORY.md` archive. The implementation does not apply trust labels, structural isolation, instruction filtering, provenance validation, or escaping designed to distinguish untrusted conversation data from trusted Agent instructions. Because these files are explicitly intended for later memory retrieval and Agent use, attacker-controlled text can persist beyond the original interaction. If another component incorporates the stored Markdown into an Agent's prompt or context without treating it strictly as untrusted data, embedded instructions may be interpreted as directives rather than historical content. The issue is therefore a persistent indirect prompt-injection and memory-poisoning risk. The reviewed code does not itself prove that stored text is automatically executed as an instruction; exploitation depends on how the surroun ...[truncated 1529 chars]
- Remediation
- ## Remediation Suggestions 1. Store memories as structured records containing explicit fields for content, source, timestamp, trust level, and whether the data was supplied by a user. 2. Mark all conversation-derived content as untrusted and ensure downstream prompts state that retrieved memory is reference data, not executable instructions. 3. Place retrieved content inside strongly delimited data sections and escape or encode formatting that could blur the boundary between instructions and stored text. 4. Do not automatically promote user-controlled content into `MEMORY.md`. Require a trusted review or a constrained extraction process that records factual summaries without retaining embedded directives. 5. Apply validation designed to detect instruction-like persistence attempts. Treat filtering as defense in depth rather than the sole protection. 6. Preserve provenance when returning search results so the consuming Agent can distinguish user statements from trusted system-generated memory. 7. Limit the quantity and scope of memory inserted into future prompts and avoid loading entire memory files into privileged Agent contexts. 8. Add security tests that save adversarial instructions, retrieve them in a later simulated session, and verify that they remain quoted as untrusted historical data rather than affecting Agent behavior.