T02 · Agent Memory Poisoning
Error
- Location
src/memory/heartflow-memory.js:242- Finding
Persistent system-prompt injection through attacker-controlled memory
- Content
View full analysis
5) { this.learn(`conversation:${uid}`, input, ['conversation', 'user_input']); } // 2. Detected emotional signal is recorded in LEARNED memory. const pain = this._extractPain(judgment); if (pain) { this.learn(`pain:${uid}`, `用户情绪信号: ${pain}`, ['emotion', 'pain']); } // 3. Current context is recorded in EPHEMERAL memory. const what = judgment.whatIsThis; if (what) { this.remember(`context:now`, { whatIsThis: typeof what === 'object' ? (what.scenario || what.category || 'unknown') : 'unknown', shouldRespond: judgment.shouldRespond, }, 3600000); } // 4. Technical-operation input is recorded verbatim in LEARNED memory. if (input.includes('修') || input.includes('改') || input.includes('升级') || input.includes('优化')) { this.learn(`tech:${uid}`, input, ['tech', 'operation']); } return { recorded: true }; } ``` ```javascript // scripts/heartflow-memory-inject.js:73-88 const pains = learnedEntries.filter(e => e.tags?.includes('pain')); const techOps = learnedEntries.filter(e => e.tags?.includes('tech')); if (pains.length > 0) { lines.push(''); lines.push('【情绪信号】'); for (const e of pains.slice(0, 5)) { lines.push(` • ${e.value}`); } } if (techOps.length > 0) { lines.push(''); lines.push('【技术操作记录】'); for (const e of techOps.slice(0, 10) ...[truncated 3348 chars]- Remediation
View remediation