T02 · Agent Memory Poisoning
Error
- Location
plugins/heartflow-memory-inject.py:83- Finding
Persistent Untrusted Memory Is Injected into the Agent System Prompt
- Content
View full analysis
'); return; } const result = hfm.learn(key, value, ['manual']); if (result.success) { console.log(`Written to LEARNED tier: [${key}] = ${value}`); } } ``` `scripts/heartflow-memory-inject.js:61-119` incorporates stored values directly into the generated prompt text: ```javascript const learnedEntries = Object.entries(hfm.learned) .map(([k, v]) => ({ key: k, ...v })) .filter(e => (e.lastAccessed || 0) >= thirtyDaysAgo) .sort((a, b) => (b.lastAccessed || 0) - (a.lastAccessed || 0)); const conversations = learnedEntries.filter(e => e.tags?.includes('conversation')); const lessons = learnedEntries.filter(e => e.tags?.includes('lesson')); const preferences = learnedEntries.filter(e => e.tags?.includes('preference')); const pains = learnedEntries.filter(e => e.tags?.includes('pain')); const techOps = learnedEntries.filter(e => e.tags?.includes('tech')); const dreams = learnedEntries.filter(e => e.tags?.includes('dream')); if (lessons.length > 0) { lines.push(''); lines.push('Stored lessons:'); for (const e of lessons.slice(0, 10)) { lines.push(` • ${e.value}`); } } if (preferences.length > 0) { lines.push(''); lines.push('User preferences:'); for (const e of preferences) { lines.push(` • ${e.value}`); } } if (conversations.length > 0) { lines.push(''); lines.push('Recent conversations:'); for (const e of conversations.slice( ...[truncated 3055 chars]- Remediation
View remediation